v27.2.0

Prepare changelog for v27.2.0
v27.2.0-rc.1
2023-08-15 13:17:57 +01:00 · 2023-08-15 13:17:55 +01:00 · 2023-08-08 15:01:44 +01:00 · 2023-08-08 15:01:41 +01:00 · 2023-08-03 08:16:18 +00:00 · 2023-08-02 20:40:32 +00:00
106 changed files with 7162 additions and 3573 deletions
@@ -66,9 +66,6 @@ module.exports = {
        // Disabled tests are a reality for now but as soon as all of the xits are
        // eliminated, we should enforce this.
        "jest/no-disabled-tests": "off",
-        // TODO: There are many tests with invalid expects that should be fixed,
-        // https://github.com/matrix-org/matrix-js-sdk/issues/2976
-        "jest/valid-expect": "off",
        // Also treat "oldBackendOnly" as a test function.
        // Used in some crypto tests.
        "jest/no-standalone-expect": [
@@ -15,7 +15,7 @@ concurrency:
 jobs:
    cypress:
        name: Cypress
-        uses: matrix-org/matrix-react-sdk/.github/workflows/cypress.yaml@v3.74.0
+        uses: matrix-org/matrix-react-sdk/.github/workflows/cypress.yaml@v3.76.0
        permissions:
            actions: read
            issues: read
@@ -1,6 +1,8 @@
 name: Build downstream artifacts
 on:
-    pull_request: {}
+    # We only want the Rust Crypto Cypress tests on merge queue to prevent regressions
+    # from creeping in. They take a long time to run and consume 4 concurrent runners.
+    # Anyone working on Rust Crypto is able to run the tests locally if required.
    merge_group:
        types: [checks_requested]

@@ -19,7 +21,7 @@ concurrency:
 jobs:
    build-element-web:
        name: Build element-web
-        uses: matrix-org/matrix-react-sdk/.github/workflows/element-web.yaml@v3.73.1
+        uses: matrix-org/matrix-react-sdk/.github/workflows/element-web.yaml@v3.76.0
        with:
            matrix-js-sdk-sha: ${{ github.sha }}
            react-sdk-repository: matrix-org/matrix-react-sdk
@@ -24,7 +24,7 @@ jobs:

            - name: 🚀 Publish to npm
              id: npm-publish
-              uses: JS-DevTools/npm-publish@a25b4180b728b0279fca97d4e5bccf391685aead # v2.2.0
+              uses: JS-DevTools/npm-publish@5a85faf05d2ade2d5b6682bfe5359915d5159c6c # v2.2.1
              with:
                  token: ${{ secrets.NPM_TOKEN }}
                  access: public
@@ -18,7 +18,7 @@ jobs:
        strategy:
            matrix:
                specs: [browserify, integ, unit]
-                node: [16, 18, latest]
+                node: [18, latest]
        steps:
            - name: Checkout code
              uses: actions/checkout@v3
@@ -50,6 +50,9 @@ jobs:
              env:
                  JEST_SONAR_UNIQUE_OUTPUT_NAME: true

+                  # tell jest to use coloured output
+                  FORCE_COLOR: true
+
            - name: Move coverage files into place
              if: env.ENABLE_COVERAGE == 'true'
              run: mv coverage/lcov.info coverage/${{ matrix.node }}-${{ matrix.specs }}.lcov.info
@@ -20,7 +20,7 @@ jobs:

            - name: Create Pull Request
              id: cpr
-              uses: peter-evans/create-pull-request@284f54f989303d2699d373481a0cfa13ad5a6666 # v5
+              uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5
              with:
                  token: ${{ secrets.ELEMENT_BOT_TOKEN }}
                  branch: actions/upgrade-deps
@@ -1,5 +1,81 @@
-Changes in [26.2.0-rc.1](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v26.2.0-rc.1) (2023-06-27)
-============================================================================================================
+Changes in [27.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v27.2.0) (2023-08-15)
+==================================================================================================
+
+## 🦖 Deprecations
+ * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**
+
+## ✨ Features
+ * Allow knocking rooms ([\#3647](https://github.com/matrix-org/matrix-js-sdk/pull/3647)). Contributed by @charlynguyen.
+ * Bump pagination limit to account for threaded events ([\#3638](https://github.com/matrix-org/matrix-js-sdk/pull/3638)).
+ * ElementR: Add `CryptoApi.findVerificationRequestDMInProgress` ([\#3601](https://github.com/matrix-org/matrix-js-sdk/pull/3601)). Contributed by @florianduros.
+ * Export more into the public interface ([\#3614](https://github.com/matrix-org/matrix-js-sdk/pull/3614)).
+
+## 🐛 Bug Fixes
+ * Fix wrong handling of encrypted rooms when loading them from sync accumulator ([\#3640](https://github.com/matrix-org/matrix-js-sdk/pull/3640)). Fixes vector-im/element-web#25803.
+ * Skip processing thread roots and fetching threads list when support is disabled ([\#3642](https://github.com/matrix-org/matrix-js-sdk/pull/3642)).
+ * Ensure we don't overinflate the total notification count ([\#3634](https://github.com/matrix-org/matrix-js-sdk/pull/3634)). Fixes vector-im/element-web#25803.
+
+Changes in [27.1.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v27.1.0) (2023-08-01)
+==================================================================================================
+
+## 🦖 Deprecations
+ * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**
+
+## ✨ Features
+ * ElementR: Add `CryptoApi.getCrossSigningKeyId` ([\#3619](https://github.com/matrix-org/matrix-js-sdk/pull/3619)). Contributed by @florianduros.
+ * ElementR: Stub `CheckOwnCrossSigningTrust`, import cross signing keys and verify local device in `bootstrapCrossSigning` ([\#3608](https://github.com/matrix-org/matrix-js-sdk/pull/3608)). Contributed by @florianduros.
+ * Specify /preview_url requests as low priority ([\#3609](https://github.com/matrix-org/matrix-js-sdk/pull/3609)). Fixes vector-im/element-web#7292.
+ * Element-R: support for displaying QR codes during verification ([\#3588](https://github.com/matrix-org/matrix-js-sdk/pull/3588)). Fixes vector-im/crypto-internal#124.
+ * Add support for scanning QR codes during verification, with Rust crypto ([\#3565](https://github.com/matrix-org/matrix-js-sdk/pull/3565)).
+ * Add methods to influence set_presence on /sync API calls ([\#3578](https://github.com/matrix-org/matrix-js-sdk/pull/3578)).
+
+## 🐛 Bug Fixes
+ * Fix threads ending up with chunks of their timelines missing ([\#3618](https://github.com/matrix-org/matrix-js-sdk/pull/3618)). Fixes vector-im/element-web#24466.
+ * Ensure we do not clobber a newer RR with an older unthreaded one ([\#3617](https://github.com/matrix-org/matrix-js-sdk/pull/3617)). Fixes vector-im/element-web#25806.
+ * Fix registration check your emails stage regression ([\#3616](https://github.com/matrix-org/matrix-js-sdk/pull/3616)).
+ * Fix how `Room::eventShouldLiveIn` handles replies to unknown parents ([\#3615](https://github.com/matrix-org/matrix-js-sdk/pull/3615)). Fixes vector-im/element-web#22603.
+ * Only send threaded read receipts if threads support is enabled ([\#3612](https://github.com/matrix-org/matrix-js-sdk/pull/3612)).
+ * ElementR: Fix `userId` parameter usage in `CryptoApi#getVerificationRequestsToDeviceInProgress` ([\#3611](https://github.com/matrix-org/matrix-js-sdk/pull/3611)). Contributed by @florianduros.
+ * Fix edge cases around non-thread relations to thread roots and read receipts ([\#3607](https://github.com/matrix-org/matrix-js-sdk/pull/3607)).
+ * Fix read receipt sending behaviour around thread roots ([\#3600](https://github.com/matrix-org/matrix-js-sdk/pull/3600)).
+ * Export typed event emitter key types ([\#3597](https://github.com/matrix-org/matrix-js-sdk/pull/3597)). Fixes #3506.
+ * Element-R: ensure that `userHasCrossSigningKeys` uses up-to-date data ([\#3599](https://github.com/matrix-org/matrix-js-sdk/pull/3599)). Fixes vector-im/element-web#25773.
+ * Fix sending `auth: null` due to broken types around UIA ([\#3594](https://github.com/matrix-org/matrix-js-sdk/pull/3594)).
+
+Changes in [27.0.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v27.0.0) (2023-07-18)
+==================================================================================================
+
+## 🚨 BREAKING CHANGES
+ * Drop support for Node 16 ([\#3533](https://github.com/matrix-org/matrix-js-sdk/pull/3533)).
+ * Improve types around login, registration, UIA and identity servers ([\#3537](https://github.com/matrix-org/matrix-js-sdk/pull/3537)).
+
+## 🦖 Deprecations
+ * **The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. (#3189)**
+ * Simplify `MatrixClient::setPowerLevel` API ([\#3570](https://github.com/matrix-org/matrix-js-sdk/pull/3570)). Fixes vector-im/element-web#13900 and #1844.
+ * Deprecate `VerificationRequest.getQRCodeBytes` and replace it with the asynchronous `generateQRCode`. ([\#3562](https://github.com/matrix-org/matrix-js-sdk/pull/3562)).
+ * Deprecate `VerificationRequest.beginKeyVerification()` in favour of `VerificationRequest.startVerification()`. ([\#3528](https://github.com/matrix-org/matrix-js-sdk/pull/3528)).
+ * Deprecate `Crypto.VerificationRequest` application event, replacing it with `Crypto.VerificationRequestReceived`. ([\#3514](https://github.com/matrix-org/matrix-js-sdk/pull/3514)).
+
+## ✨ Features
+ * Throw saner error when peeking has its room pulled out from under it ([\#3577](https://github.com/matrix-org/matrix-js-sdk/pull/3577)). Fixes vector-im/element-web#18679.
+ * OIDC: Log in ([\#3554](https://github.com/matrix-org/matrix-js-sdk/pull/3554)). Contributed by @kerryarchibald.
+ * Prevent threads code from making identical simultaneous API hits ([\#3541](https://github.com/matrix-org/matrix-js-sdk/pull/3541)). Fixes vector-im/element-web#25395.
+ * Update IUnsigned type to be extensible ([\#3547](https://github.com/matrix-org/matrix-js-sdk/pull/3547)).
+ * add stop() api to BackupManager for clean shutdown ([\#3553](https://github.com/matrix-org/matrix-js-sdk/pull/3553)).
+ * Log the message ID of any undecryptable to-device messages ([\#3543](https://github.com/matrix-org/matrix-js-sdk/pull/3543)).
+ * Ignore thread relations on state events for consistency with edits ([\#3540](https://github.com/matrix-org/matrix-js-sdk/pull/3540)).
+ * OIDC: validate id token ([\#3531](https://github.com/matrix-org/matrix-js-sdk/pull/3531)). Contributed by @kerryarchibald.
+
+## 🐛 Bug Fixes
+ * Fix read receipt sending behaviour around thread roots ([\#3600](https://github.com/matrix-org/matrix-js-sdk/pull/3600)).
+ * Fix `TypedEventEmitter::removeAllListeners(void)` not working ([\#3561](https://github.com/matrix-org/matrix-js-sdk/pull/3561)).
+ * Don't allow Olm unwedging rate-limiting to race ([\#3549](https://github.com/matrix-org/matrix-js-sdk/pull/3549)). Fixes vector-im/element-web#25716.
+ * Fix an instance of failed to decrypt error when an in flight `/keys/query` fails. ([\#3486](https://github.com/matrix-org/matrix-js-sdk/pull/3486)).
+ * Use the right anchor emoji for SAS verification ([\#3534](https://github.com/matrix-org/matrix-js-sdk/pull/3534)).
+ * fix a bug which caused the wrong emoji to be shown during SAS device verification. ([\#3523](https://github.com/matrix-org/matrix-js-sdk/pull/3523)).
+
+Changes in [26.2.0](https://github.com/matrix-org/matrix-js-sdk/releases/tag/v26.2.0) (2023-07-04)
+==================================================================================================

 ## 🦖 Deprecations
 * The Browserify artifact is being deprecated, scheduled for removal in the October 10th release cycle. ([\#3189](https://github.com/matrix-org/matrix-js-sdk/issues/3189)).
@@ -21,6 +21,8 @@ endpoints from before Matrix 1.1, for example.

 ## In a browser

+### Note, the browserify build has been deprecated. Please use a bundler like webpack or vite instead.
+
 Download the browser version from
 https://github.com/matrix-org/matrix-js-sdk/releases/latest and add that as a
 `<script>` to your page. There will be a global variable `matrixcs`
@@ -1,9 +1,9 @@
 {
    "name": "matrix-js-sdk",
-    "version": "26.2.0-rc.1",
+    "version": "27.2.0",
    "description": "Matrix Client-Server SDK for Javascript",
    "engines": {
-        "node": ">=16.0.0"
+        "node": ">=18.0.0"
    },
    "scripts": {
        "prepublishOnly": "yarn build",
@@ -55,13 +55,15 @@
    ],
    "dependencies": {
        "@babel/runtime": "^7.12.5",
-        "@matrix-org/matrix-sdk-crypto-js": "^0.1.0-alpha.11",
+        "@matrix-org/matrix-sdk-crypto-wasm": "^1.2.0",
        "another-json": "^0.2.0",
        "bs58": "^5.0.0",
        "content-type": "^1.0.4",
+        "jwt-decode": "^3.1.2",
        "loglevel": "^1.7.1",
        "matrix-events-sdk": "0.0.1",
-        "matrix-widget-api": "^1.3.1",
+        "matrix-widget-api": "^1.5.0",
+        "oidc-client-ts": "^2.2.4",
        "p-retry": "4",
        "sdp-transform": "^2.14.1",
        "unhomoglyph": "^1.0.6",
@@ -95,13 +97,11 @@
        "allchange": "^1.0.6",
        "babel-jest": "^29.0.0",
        "babelify": "^10.0.0",
-        "better-docs": "^2.4.0-beta.9",
        "browserify": "^17.0.0",
        "browserify-swap": "^0.2.2",
        "debug": "^4.3.4",
-        "docdash": "^2.0.0",
        "domexception": "^4.0.0",
-        "eslint": "8.41.0",
+        "eslint": "8.45.0",
        "eslint-config-google": "^0.14.0",
        "eslint-config-prettier": "^8.5.0",
        "eslint-import-resolver-typescript": "^3.5.1",
@@ -110,7 +110,7 @@
        "eslint-plugin-jsdoc": "^46.0.0",
        "eslint-plugin-matrix-org": "^1.0.0",
        "eslint-plugin-tsdoc": "^0.2.17",
-        "eslint-plugin-unicorn": "^47.0.0",
+        "eslint-plugin-unicorn": "^48.0.0",
        "exorcist": "^2.0.0",
        "fake-indexeddb": "^4.0.0",
        "fetch-mock-jest": "^1.5.1",
@@ -32,8 +32,6 @@ import { syncPromise } from "./test-utils/test-utils";
 import { createClient, IStartClientOpts } from "../src/matrix";
 import { ICreateClientOpts, IDownloadKeyResult, MatrixClient, PendingEventOrdering } from "../src/client";
 import { MockStorageApi } from "./MockStorageApi";
-import { encodeUri } from "../src/utils";
-import { IKeyBackupSession } from "../src/crypto/keybackup";
 import { IKeysUploadResponse, IUploadKeysRequest } from "../src/client";
 import { ISyncResponder } from "./test-utils/SyncResponder";

@@ -214,21 +212,6 @@ export class TestClient implements IE2EKeyReceiver, ISyncResponder {
        });
    }

-    /**
-     * Set up expectations that the client will query key backups for a particular session
-     */
-    public expectKeyBackupQuery(roomId: string, sessionId: string, status: number, response: IKeyBackupSession) {
-        this.httpBackend
-            .when(
-                "GET",
-                encodeUri("/room_keys/keys/$roomId/$sessionId", {
-                    $roomId: roomId,
-                    $sessionId: sessionId,
-                }),
-            )
-            .respond(status, response);
-    }
-
    /**
     * get the uploaded curve25519 device key
     *
@@ -18,9 +18,22 @@ import fetchMock from "fetch-mock-jest";
 import "fake-indexeddb/auto";
 import { IDBFactory } from "fake-indexeddb";

-import { CRYPTO_BACKENDS, InitCrypto } from "../../test-utils/test-utils";
-import { createClient, IAuthDict, MatrixClient } from "../../../src";
-import { mockSetupCrossSigningRequests } from "../../test-utils/mockEndpoints";
+import { CRYPTO_BACKENDS, InitCrypto, syncPromise } from "../../test-utils/test-utils";
+import { AuthDict, createClient, CryptoEvent, MatrixClient } from "../../../src";
+import { mockInitialApiRequests, mockSetupCrossSigningRequests } from "../../test-utils/mockEndpoints";
+import { encryptAES } from "../../../src/crypto/aes";
+import { CryptoCallbacks, CrossSigningKey } from "../../../src/crypto-api";
+import { SECRET_STORAGE_ALGORITHM_V1_AES } from "../../../src/secret-storage";
+import { ISyncResponder, SyncResponder } from "../../test-utils/SyncResponder";
+import { E2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
+import {
+    MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64,
+    SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64,
+    SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64,
+    SIGNED_CROSS_SIGNING_KEYS_DATA,
+    USER_CROSS_SIGNING_PRIVATE_KEY_BASE64,
+} from "../../test-utils/test-data";
+import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";

 afterEach(() => {
    // reset fake-indexeddb after each test, to make sure we don't leak connections
@@ -39,8 +52,32 @@ const TEST_DEVICE_ID = "xzcvb";
 * to provide the most effective integration tests possible.
 */
 describe.each(Object.entries(CRYPTO_BACKENDS))("cross-signing (%s)", (backend: string, initCrypto: InitCrypto) => {
+    // newBackendOnly is the opposite to `oldBackendOnly`: it will skip the test if we are running against the legacy
+    // backend. Once we drop support for legacy crypto, it will go away.
+    const newBackendOnly = backend === "rust-sdk" ? test : test.skip;
+
    let aliceClient: MatrixClient;

+    /** an object which intercepts `/sync` requests from {@link #aliceClient} */
+    let syncResponder: ISyncResponder;
+
+    /** an object which intercepts `/keys/query` requests on the test homeserver */
+    let e2eKeyResponder: E2EKeyResponder;
+
+    // Encryption key used to encrypt cross signing keys
+    const encryptionKey = new Uint8Array(32);
+
+    /**
+     * Create the {@link CryptoCallbacks}
+     */
+    function createCryptoCallbacks(): CryptoCallbacks {
+        return {
+            getSecretStorageKey: (keys, name) => {
+                return Promise.resolve<[string, Uint8Array]>(["key_id", encryptionKey]);
+            },
+        };
+    }
+
    beforeEach(async () => {
        // anything that we don't have a specific matcher for silently returns a 404
        fetchMock.catch(404);
@@ -52,8 +89,14 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("cross-signing (%s)", (backend: s
            userId: TEST_USER_ID,
            accessToken: "akjgkrgjs",
            deviceId: TEST_DEVICE_ID,
+            cryptoCallbacks: createCryptoCallbacks(),
        });

+        syncResponder = new SyncResponder(homeserverUrl);
+        e2eKeyResponder = new E2EKeyResponder(homeserverUrl);
+        /** an object which intercepts `/keys/upload` requests on the test homeserver */
+        new E2EKeyReceiver(homeserverUrl);
+
        await initCrypto(aliceClient);
    });

@@ -68,7 +111,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("cross-signing (%s)", (backend: s
     * @param authDict - The parameters to as the `auth` dict in the key upload request.
     * @see https://spec.matrix.org/v1.6/client-server-api/#authentication-types
     */
-    async function bootstrapCrossSigning(authDict: IAuthDict): Promise<void> {
+    async function bootstrapCrossSigning(authDict: AuthDict): Promise<void> {
        await aliceClient.getCrypto()?.bootstrapCrossSigning({
            authUploadDeviceSigningKeys: (makeRequest) => makeRequest(authDict).then(() => undefined),
        });
@@ -105,6 +148,94 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("cross-signing (%s)", (backend: s
                `[${TEST_USER_ID}].[${TEST_DEVICE_ID}].signatures.[${TEST_USER_ID}].[${sskId}]`,
            );
        });
+
+        newBackendOnly("get cross signing keys from secret storage and import them", async () => {
+            // Return public cross signing keys
+            e2eKeyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);
+
+            mockInitialApiRequests(aliceClient.getHomeserverUrl());
+
+            // Encrypt the private keys and return them in the /sync response as if they are in Secret Storage
+            const masterKey = await encryptAES(
+                MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64,
+                encryptionKey,
+                "m.cross_signing.master",
+            );
+            const selfSigningKey = await encryptAES(
+                SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64,
+                encryptionKey,
+                "m.cross_signing.self_signing",
+            );
+            const userSigningKey = await encryptAES(
+                USER_CROSS_SIGNING_PRIVATE_KEY_BASE64,
+                encryptionKey,
+                "m.cross_signing.user_signing",
+            );
+
+            syncResponder.sendOrQueueSyncResponse({
+                next_batch: 1,
+                account_data: {
+                    events: [
+                        {
+                            type: "m.cross_signing.master",
+                            content: {
+                                encrypted: {
+                                    key_id: masterKey,
+                                },
+                            },
+                        },
+                        {
+                            type: "m.cross_signing.self_signing",
+                            content: {
+                                encrypted: {
+                                    key_id: selfSigningKey,
+                                },
+                            },
+                        },
+                        {
+                            type: "m.cross_signing.user_signing",
+                            content: {
+                                encrypted: {
+                                    key_id: userSigningKey,
+                                },
+                            },
+                        },
+                        {
+                            type: "m.secret_storage.key.key_id",
+                            content: {
+                                key: "key_id",
+                                algorithm: SECRET_STORAGE_ALGORITHM_V1_AES,
+                            },
+                        },
+                    ],
+                },
+            });
+            await aliceClient.startClient();
+            await syncPromise(aliceClient);
+
+            // we expect a request to upload signatures for our device ...
+            fetchMock.post({ url: "path:/_matrix/client/v3/keys/signatures/upload", name: "upload-sigs" }, {});
+
+            // we expect the UserTrustStatusChanged event to be fired after the cross signing keys import
+            const userTrustStatusChangedPromise = new Promise<string>((resolve) =>
+                aliceClient.on(CryptoEvent.UserTrustStatusChanged, resolve),
+            );
+
+            const authDict = { type: "test" };
+            await bootstrapCrossSigning(authDict);
+
+            // Check if the UserTrustStatusChanged event was fired
+            expect(await userTrustStatusChangedPromise).toBe(aliceClient.getUserId());
+
+            // Expect the signature to be uploaded
+            expect(fetchMock.called("upload-sigs")).toBeTruthy();
+            const [, sigsOpts] = fetchMock.lastCall("upload-sigs")!;
+            const body = JSON.parse(sigsOpts!.body as string);
+            // the device should have a signature with the public self cross signing keys.
+            expect(body).toHaveProperty(
+                `[${TEST_USER_ID}].[${TEST_DEVICE_ID}].signatures.[${TEST_USER_ID}].[ed25519:${SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64}]`,
+            );
+        });
    });

    describe("getCrossSigningStatus()", () => {
@@ -157,4 +288,55 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("cross-signing (%s)", (backend: s
            expect(isCrossSigningReady).toBeTruthy();
        });
    });
+
+    describe("getCrossSigningKeyId", () => {
+        /**
+         * Intercept /keys/device_signing/upload request and return the cross signing keys
+         * https://spec.matrix.org/v1.7/client-server-api/#post_matrixclientv3keysdevice_signingupload
+         *
+         * @returns the cross signing keys
+         */
+        function awaitCrossSigningKeysUpload() {
+            return new Promise<any>((resolve) => {
+                fetchMock.post(
+                    // legacy crypto uses /unstable/; /v3/ is correct
+                    {
+                        url: new RegExp("/_matrix/client/(unstable|v3)/keys/device_signing/upload"),
+                        name: "upload-keys",
+                    },
+                    (url, options) => {
+                        const content = JSON.parse(options.body as string);
+                        resolve(content);
+                        return {};
+                    },
+                    // Override the routes define in `mockSetupCrossSigningRequests`
+                    { overwriteRoutes: true },
+                );
+            });
+        }
+
+        it("should return the cross signing key id for each cross signing key", async () => {
+            mockSetupCrossSigningRequests();
+
+            // Intercept cross signing keys upload
+            const crossSigningKeysPromise = awaitCrossSigningKeysUpload();
+
+            // provide a UIA callback, so that the cross-signing keys are uploaded
+            const authDict = { type: "test" };
+            await bootstrapCrossSigning(authDict);
+            // Get the cross signing keys
+            const crossSigningKeys = await crossSigningKeysPromise;
+
+            const getPubKey = (crossSigningKey: any) => Object.values(crossSigningKey!.keys)[0];
+
+            const masterKeyId = await aliceClient.getCrypto()!.getCrossSigningKeyId();
+            expect(masterKeyId).toBe(getPubKey(crossSigningKeys.master_key));
+
+            const selfSigningKeyId = await aliceClient.getCrypto()!.getCrossSigningKeyId(CrossSigningKey.SelfSigning);
+            expect(selfSigningKeyId).toBe(getPubKey(crossSigningKeys.self_signing_key));
+
+            const userSigningKeyId = await aliceClient.getCrypto()!.getCrossSigningKeyId(CrossSigningKey.UserSigning);
+            expect(userSigningKeyId).toBe(getPubKey(crossSigningKeys.user_signing_key));
+        });
+    });
 });
@@ -20,22 +20,23 @@ import fetchMock from "fetch-mock-jest";
 import "fake-indexeddb/auto";
 import { IDBFactory } from "fake-indexeddb";
 import { MockResponse, MockResponseFunction } from "fetch-mock";
+import Olm from "@matrix-org/olm";

 import type { IDeviceKeys } from "../../../src/@types/crypto";
 import * as testUtils from "../../test-utils/test-utils";
-import { CRYPTO_BACKENDS, InitCrypto, syncPromise } from "../../test-utils/test-utils";
+import { CRYPTO_BACKENDS, getSyncResponse, InitCrypto, syncPromise } from "../../test-utils/test-utils";
+import { TEST_ROOM_ID, TEST_ROOM_ID as ROOM_ID, TEST_USER_ID } from "../../test-utils/test-data";
 import { TestClient } from "../../TestClient";
 import { logger } from "../../../src/logger";
 import {
+    Category,
    createClient,
    IClaimOTKsResult,
    IContent,
    IDownloadKeyResult,
    IEvent,
-    IJoinedRoom,
    IndexedDBCryptoStore,
    IStartClientOpts,
-    ISyncResponse,
    MatrixClient,
    MatrixEvent,
    MatrixEventEvent,
@@ -43,6 +44,7 @@ import {
    Room,
    RoomMember,
    RoomStateEvent,
+    IRoomEvent,
 } from "../../../src/matrix";
 import { DeviceInfo } from "../../../src/crypto/deviceinfo";
 import { E2EKeyReceiver, IE2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
@@ -53,8 +55,7 @@ import { flushPromises } from "../../test-utils/flushPromises";
 import { mockInitialApiRequests, mockSetupCrossSigningRequests } from "../../test-utils/mockEndpoints";
 import { AddSecretStorageKeyOpts, SECRET_STORAGE_ALGORITHM_V1_AES } from "../../../src/secret-storage";
 import { CryptoCallbacks } from "../../../src/crypto-api";
-
-const ROOM_ID = "!room:id";
+import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";

 afterEach(() => {
    // reset fake-indexeddb after each test, to make sure we don't leak connections
@@ -156,18 +157,23 @@ function encryptMegolmEvent(opts: {
        expect(opts.room_id).toBeTruthy();
        plaintext.room_id = opts.room_id;
    }
-    return encryptMegolmEventRawPlainText({ senderKey: opts.senderKey, groupSession: opts.groupSession, plaintext });
+    return encryptMegolmEventRawPlainText({
+        senderKey: opts.senderKey,
+        groupSession: opts.groupSession,
+        plaintext,
+    });
 }

 function encryptMegolmEventRawPlainText(opts: {
    senderKey: string;
    groupSession: Olm.OutboundGroupSession;
    plaintext: Partial<IEvent>;
+    origin_server_ts?: number;
 }): IEvent {
    return {
        event_id: "$test_megolm_event_" + Math.random(),
-        sender: "@not_the_real_sender:example.com",
-        origin_server_ts: 1672944778000,
+        sender: opts.plaintext.sender ?? "@not_the_real_sender:example.com",
+        origin_server_ts: opts.plaintext.origin_server_ts ?? 1672944778000,
        content: {
            algorithm: "m.megolm.v1.aes-sha2",
            ciphertext: opts.groupSession.encrypt(JSON.stringify(opts.plaintext)),
@@ -213,55 +219,6 @@ function encryptGroupSessionKey(opts: {
    });
 }

-// get a /sync response which contains a single room (ROOM_ID), with the members given
-function getSyncResponse(roomMembers: string[]): ISyncResponse {
-    const roomResponse: IJoinedRoom = {
-        summary: {
-            "m.heroes": [],
-            "m.joined_member_count": roomMembers.length,
-            "m.invited_member_count": roomMembers.length,
-        },
-        state: {
-            events: [
-                testUtils.mkEventCustom({
-                    sender: roomMembers[0],
-                    type: "m.room.encryption",
-                    state_key: "",
-                    content: {
-                        algorithm: "m.megolm.v1.aes-sha2",
-                    },
-                }),
-            ],
-        },
-        timeline: {
-            events: [],
-            prev_batch: "",
-        },
-        ephemeral: { events: [] },
-        account_data: { events: [] },
-        unread_notifications: {},
-    };
-
-    for (let i = 0; i < roomMembers.length; i++) {
-        roomResponse.state.events.push(
-            testUtils.mkMembershipCustom({
-                membership: "join",
-                sender: roomMembers[i],
-            }),
-        );
-    }
-
-    return {
-        next_batch: "1",
-        rooms: {
-            join: { [ROOM_ID]: roomResponse },
-            invite: {},
-            leave: {},
-        },
-        account_data: { events: [] },
-    };
-}
-
 /**
 * Establish an Olm Session with the test user
 *
@@ -415,7 +372,10 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
    let aliceClient: MatrixClient;

    /** an object which intercepts `/keys/upload` requests from {@link #aliceClient} to catch the uploaded keys */
-    let keyReceiver: IE2EKeyReceiver;
+    let keyReceiver: E2EKeyReceiver;
+
+    /** an object which intercepts `/keys/query` requests on the test homeserver */
+    let keyResponder: E2EKeyResponder;

    /** an object which intercepts `/sync` requests from {@link #aliceClient} */
    let syncResponder: ISyncResponder;
@@ -586,6 +546,10 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,

    afterEach(async () => {
        await aliceClient.stopClient();
+
+        // Allow in-flight things to complete before we tear down the test
+        await jest.runAllTimersAsync();
+
        fetchMock.mockReset();
    });

@@ -708,6 +672,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
        await syncPromise(aliceClient);

        await testUtils.awaitDecryption(event, { waitOnDecryptionFailure: true });
+        expect(event.isDecryptionFailure()).toBeFalsy();
        expect(event.getContent().body).toEqual("42");
    });

@@ -2411,4 +2376,193 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("crypto (%s)", (backend: string,
            expect(selfSigningKey[secretStorageKey]).toBeDefined();
        });
    });
+
+    describe("Incoming verification in a DM", () => {
+        beforeEach(async () => {
+            // anything that we don't have a specific matcher for silently returns a 404
+            fetchMock.catch(404);
+
+            keyResponder = new E2EKeyResponder(aliceClient.getHomeserverUrl());
+            keyResponder.addKeyReceiver(TEST_USER_ID, keyReceiver);
+
+            expectAliceKeyQuery({ device_keys: { "@alice:localhost": {} }, failures: {} });
+            await startClientAndAwaitFirstSync();
+        });
+
+        afterEach(() => {
+            jest.useRealTimers();
+        });
+
+        /**
+         * Return a verification request event from Bob
+         * @see https://spec.matrix.org/v1.7/client-server-api/#mkeyverificationrequest
+         */
+        function createVerificationRequestEvent(): IRoomEvent {
+            return {
+                content: {
+                    body: "Verification request from Bob to Alice",
+                    from_device: "BobDevice",
+                    methods: ["m.sas.v1"],
+                    msgtype: "m.key.verification.request",
+                    to: aliceClient.getUserId()!,
+                },
+                event_id: "$143273582443PhrSn:example.org",
+                origin_server_ts: Date.now(),
+                room_id: TEST_ROOM_ID,
+                sender: "@bob:xyz",
+                type: "m.room.message",
+                unsigned: {
+                    age: 1234,
+                },
+            };
+        }
+
+        /**
+         * Create a to-device event
+         * @param groupSession
+         * @param p2pSession
+         */
+        function createToDeviceEvent(groupSession: Olm.OutboundGroupSession, p2pSession: Olm.Session): Partial<IEvent> {
+            return encryptGroupSessionKey({
+                recipient: aliceClient.getUserId()!,
+                recipientCurve25519Key: keyReceiver.getDeviceKey(),
+                recipientEd25519Key: keyReceiver.getSigningKey(),
+                olmAccount: testOlmAccount,
+                p2pSession: p2pSession,
+                groupSession: groupSession,
+                room_id: ROOM_ID,
+            });
+        }
+
+        /**
+         * Create and encrypt a verification request event
+         * @param groupSession
+         */
+        function createEncryptedMessage(groupSession: Olm.OutboundGroupSession): IEvent {
+            return encryptMegolmEvent({
+                senderKey: testSenderKey,
+                groupSession: groupSession,
+                room_id: ROOM_ID,
+                plaintext: createVerificationRequestEvent(),
+            });
+        }
+
+        newBackendOnly("Verification request from Bob to Alice", async () => {
+            // Tell alice she is sharing a room with bob
+            const syncResponse = getSyncResponse(["@bob:xyz"]);
+
+            // Add verification request from Bob to Alice in the DM between them
+            syncResponse.rooms[Category.Join][TEST_ROOM_ID].timeline.events.push(createVerificationRequestEvent());
+            syncResponder.sendOrQueueSyncResponse(syncResponse);
+            // Wait for the sync response to be processed
+            await syncPromise(aliceClient);
+
+            const request = aliceClient.getCrypto()!.findVerificationRequestDMInProgress(TEST_ROOM_ID, "@bob:xyz");
+            // Expect to find the verification request received during the sync
+            expect(request?.roomId).toBe(TEST_ROOM_ID);
+            expect(request?.isSelfVerification).toBe(false);
+            expect(request?.otherUserId).toBe("@bob:xyz");
+        });
+
+        newBackendOnly("Verification request not found", async () => {
+            // Tell alice she is sharing a room with bob
+            syncResponder.sendOrQueueSyncResponse(getSyncResponse(["@bob:xyz"]));
+            // Wait for the sync response to be processed
+            await syncPromise(aliceClient);
+
+            // Expect to not find any verification request
+            const request = aliceClient.getCrypto()!.findVerificationRequestDMInProgress(TEST_ROOM_ID, "@bob:xyz");
+            expect(request).not.toBeDefined();
+        });
+
+        newBackendOnly("Process encrypted verification request", async () => {
+            const p2pSession = await createOlmSession(testOlmAccount, keyReceiver);
+            const groupSession = new Olm.OutboundGroupSession();
+            groupSession.create();
+
+            // make the room_key event, but don't send it yet
+            const toDeviceEvent = createToDeviceEvent(groupSession, p2pSession);
+
+            // Add verification request from Bob to Alice in the DM between them
+            syncResponder.sendOrQueueSyncResponse({
+                next_batch: 1,
+                rooms: { join: { [ROOM_ID]: { timeline: { events: [createEncryptedMessage(groupSession)] } } } },
+            });
+            // Wait for the sync response to be processed
+            await syncPromise(aliceClient);
+
+            const room = aliceClient.getRoom(ROOM_ID)!;
+            const matrixEvent = room.getLiveTimeline().getEvents()[0];
+
+            // wait for a first attempt at decryption: should fail
+            await testUtils.awaitDecryption(matrixEvent);
+            expect(matrixEvent.getContent().msgtype).toEqual("m.bad.encrypted");
+
+            // Send the Bob's keys
+            syncResponder.sendOrQueueSyncResponse({
+                next_batch: 2,
+                to_device: {
+                    events: [toDeviceEvent],
+                },
+            });
+            await syncPromise(aliceClient);
+
+            // Wait for the message to be decrypted
+            await testUtils.awaitDecryption(matrixEvent, { waitOnDecryptionFailure: true });
+
+            const request = aliceClient.getCrypto()!.findVerificationRequestDMInProgress(TEST_ROOM_ID, "@bob:xyz");
+            // Expect to find the verification request received during the sync
+            expect(request?.roomId).toBe(TEST_ROOM_ID);
+            expect(request?.isSelfVerification).toBe(false);
+            expect(request?.otherUserId).toBe("@bob:xyz");
+        });
+
+        newBackendOnly(
+            "If Bob keys are not received in the 5mins after the verification request, the request is ignored",
+            async () => {
+                const p2pSession = await createOlmSession(testOlmAccount, keyReceiver);
+                const groupSession = new Olm.OutboundGroupSession();
+                groupSession.create();
+
+                // make the room_key event, but don't send it yet
+                const toDeviceEvent = createToDeviceEvent(groupSession, p2pSession);
+
+                jest.useFakeTimers();
+
+                // Add verification request from Bob to Alice in the DM between them
+                syncResponder.sendOrQueueSyncResponse({
+                    next_batch: 1,
+                    rooms: { join: { [ROOM_ID]: { timeline: { events: [createEncryptedMessage(groupSession)] } } } },
+                });
+                // Wait for the sync response to be processed
+                await syncPromise(aliceClient);
+
+                const room = aliceClient.getRoom(ROOM_ID)!;
+                const matrixEvent = room.getLiveTimeline().getEvents()[0];
+
+                // wait for a first attempt at decryption: should fail
+                await testUtils.awaitDecryption(matrixEvent);
+                expect(matrixEvent.getContent().msgtype).toEqual("m.bad.encrypted");
+
+                // Advance time by 5mins, the verification request should be ignored after that
+                jest.advanceTimersByTime(5 * 60 * 1000);
+
+                // Send the Bob's keys
+                syncResponder.sendOrQueueSyncResponse({
+                    next_batch: 2,
+                    to_device: {
+                        events: [toDeviceEvent],
+                    },
+                });
+                await syncPromise(aliceClient);
+
+                // Wait for the message to be decrypted
+                await testUtils.awaitDecryption(matrixEvent, { waitOnDecryptionFailure: true });
+
+                const request = aliceClient.getCrypto()!.findVerificationRequestDMInProgress(TEST_ROOM_ID, "@bob:xyz");
+                // the request should not be present
+                expect(request).not.toBeDefined();
+            },
+        );
+    });
 });
@@ -14,17 +14,25 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { Account } from "@matrix-org/olm";
+import fetchMock from "fetch-mock-jest";
+import "fake-indexeddb/auto";
+import { IDBFactory } from "fake-indexeddb";

-import { logger } from "../../../src/logger";
-import { decodeRecoveryKey } from "../../../src/crypto/recoverykey";
-import { IKeyBackupInfo, IKeyBackupSession } from "../../../src/crypto/keybackup";
-import { TestClient } from "../../TestClient";
-import { IEvent } from "../../../src";
-import { MatrixEvent, MatrixEventEvent } from "../../../src/models/event";
+import { IKeyBackupSession } from "../../../src/crypto/keybackup";
+import { createClient, CryptoEvent, ICreateClientOpts, IEvent, MatrixClient } from "../../../src";
+import { SyncResponder } from "../../test-utils/SyncResponder";
+import { E2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
+import { E2EKeyResponder } from "../../test-utils/E2EKeyResponder";
+import { mockInitialApiRequests } from "../../test-utils/mockEndpoints";
+import { awaitDecryption, CRYPTO_BACKENDS, InitCrypto, syncPromise } from "../../test-utils/test-utils";
+import * as testData from "../../test-utils/test-data";
+import { KeyBackupInfo } from "../../../src/crypto-api/keybackup";

 const ROOM_ID = "!ROOM:ID";

+/** The homeserver url that we give to the test client, and where we intercept /sync, /keys, etc requests. */
+const TEST_HOMESERVER_URL = "https://alice-server.com";
+
 const SESSION_ID = "o+21hSjP+mgEmcfdslPsQdvzWnkdt0Wyo00Kp++R8Kc";

 const ENCRYPTED_EVENT: Partial<IEvent> = {
@@ -65,62 +73,70 @@ const CURVE25519_KEY_BACKUP_DATA: IKeyBackupSession = {
    },
 };

-const CURVE25519_BACKUP_INFO: IKeyBackupInfo = {
-    algorithm: "m.megolm_backup.v1.curve25519-aes-sha2",
-    version: "1",
-    auth_data: {
-        public_key: "hSDwCYkwp1R0i33ctD73Wg2/Og0mOBr066SpjqqbTmo",
-    },
-};
+const TEST_USER_ID = "@alice:localhost";
+const TEST_DEVICE_ID = "xzcvb";

-const RECOVERY_KEY = "EsTc LW2K PGiF wKEA 3As5 g5c4 BXwk qeeJ ZJV8 Q9fu gUMN UE4d";
+afterEach(() => {
+    // reset fake-indexeddb after each test, to make sure we don't leak connections
+    // cf https://github.com/dumbmatter/fakeIndexedDB#wipingresetting-the-indexeddb-for-a-fresh-state
+    // eslint-disable-next-line no-global-assign
+    indexedDB = new IDBFactory();
+});

-/**
- * start an Olm session with a given recipient
- */
-function createOlmSession(olmAccount: Olm.Account, recipientTestClient: TestClient): Promise<Olm.Session> {
-    return recipientTestClient.awaitOneTimeKeyUpload().then((keys) => {
-        const otkId = Object.keys(keys)[0];
-        const otk = keys[otkId];
+describe.each(Object.entries(CRYPTO_BACKENDS))("megolm-keys backup (%s)", (backend: string, initCrypto: InitCrypto) => {
+    // oldBackendOnly is an alternative to `it` or `test` which will skip the test if we are running against the
+    // Rust backend. Once we have full support in the rust sdk, it will go away.
+    const oldBackendOnly = backend === "rust-sdk" ? test.skip : test;

-        const session = new global.Olm.Session();
-        session.create_outbound(olmAccount, recipientTestClient.getDeviceKey(), otk.key);
-        return session;
+    let aliceClient: MatrixClient;
+    /** an object which intercepts `/sync` requests on the test homeserver */
+    let syncResponder: SyncResponder;
+
+    /** an object which intercepts `/keys/upload` requests on the test homeserver */
+    let e2eKeyReceiver: E2EKeyReceiver;
+    /** an object which intercepts `/keys/query` requests on the test homeserver */
+    let e2eKeyResponder: E2EKeyResponder;
+
+    jest.useFakeTimers();
+
+    beforeEach(async () => {
+        // anything that we don't have a specific matcher for silently returns a 404
+        fetchMock.catch(404);
+        fetchMock.config.warnOnFallback = false;
+
+        mockInitialApiRequests(TEST_HOMESERVER_URL);
+        syncResponder = new SyncResponder(TEST_HOMESERVER_URL);
+        e2eKeyReceiver = new E2EKeyReceiver(TEST_HOMESERVER_URL);
+        e2eKeyResponder = new E2EKeyResponder(TEST_HOMESERVER_URL);
+        e2eKeyResponder.addDeviceKeys(testData.SIGNED_TEST_DEVICE_DATA);
+        e2eKeyResponder.addKeyReceiver(TEST_USER_ID, e2eKeyReceiver);
    });
-}

-describe("megolm key backups", function () {
-    if (!global.Olm) {
-        logger.warn("not running megolm tests: Olm not present");
-        return;
+    afterEach(async () => {
+        if (aliceClient !== undefined) {
+            await aliceClient.stopClient();
+        }
+
+        // Allow in-flight things to complete before we tear down the test
+        await jest.runAllTimersAsync();
+
+        fetchMock.mockReset();
+    });
+
+    async function initTestClient(opts: Partial<ICreateClientOpts> = {}): Promise<MatrixClient> {
+        const client = createClient({
+            baseUrl: TEST_HOMESERVER_URL,
+            userId: TEST_USER_ID,
+            accessToken: "akjgkrgjs",
+            deviceId: TEST_DEVICE_ID,
+            ...opts,
+        });
+        await initCrypto(client);
+
+        return client;
    }
-    const Olm = global.Olm;
-    let testOlmAccount: Olm.Account;
-    let aliceTestClient: TestClient;

-    const setupTestClient = (): [Account, TestClient] => {
-        const aliceTestClient = new TestClient("@alice:localhost", "xzcvb", "akjgkrgjs");
-        const testOlmAccount = new Olm.Account();
-        testOlmAccount!.create();
-
-        return [testOlmAccount, aliceTestClient];
-    };
-
-    beforeAll(function () {
-        return Olm.init();
-    });
-
-    beforeEach(async function () {
-        [testOlmAccount, aliceTestClient] = setupTestClient();
-        await aliceTestClient!.client.initCrypto();
-        aliceTestClient!.client.crypto!.backupManager.backupInfo = CURVE25519_BACKUP_INFO;
-    });
-
-    afterEach(function () {
-        return aliceTestClient!.stop();
-    });
-
-    it("Alice checks key backups when receiving a message she can't decrypt", function () {
+    oldBackendOnly("Alice checks key backups when receiving a message she can't decrypt", async function () {
        const syncResponse = {
            next_batch: 1,
            rooms: {
@@ -134,37 +150,152 @@ describe("megolm key backups", function () {
            },
        };

-        return aliceTestClient!
-            .start()
-            .then(() => {
-                return createOlmSession(testOlmAccount, aliceTestClient);
-            })
-            .then(() => {
-                const privkey = decodeRecoveryKey(RECOVERY_KEY);
-                return aliceTestClient!.client!.crypto!.storeSessionBackupPrivateKey(privkey);
-            })
-            .then(() => {
-                aliceTestClient!.httpBackend.when("GET", "/sync").respond(200, syncResponse);
-                aliceTestClient!.expectKeyBackupQuery(ROOM_ID, SESSION_ID, 200, CURVE25519_KEY_BACKUP_DATA);
-                return aliceTestClient!.httpBackend.flushAllExpected();
-            })
-            .then(function (): Promise<MatrixEvent> {
-                const room = aliceTestClient!.client.getRoom(ROOM_ID)!;
-                const event = room.getLiveTimeline().getEvents()[0];
+        fetchMock.get("express:/_matrix/client/v3/room_keys/keys/:room_id/:session_id", CURVE25519_KEY_BACKUP_DATA);
+        fetchMock.get("path:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA);

-                if (event.getContent()) {
-                    return Promise.resolve(event);
-                }
+        aliceClient = await initTestClient();
+        const aliceCrypto = aliceClient.getCrypto()!;
+        await aliceCrypto.storeSessionBackupPrivateKey(Buffer.from(testData.BACKUP_DECRYPTION_KEY_BASE64, "base64"));

-                return new Promise((resolve, reject) => {
-                    event.once(MatrixEventEvent.Decrypted, (ev) => {
-                        logger.log(`${Date.now()} event ${event.getId()} now decrypted`);
-                        resolve(ev);
-                    });
-                });
-            })
-            .then((event) => {
-                expect(event.getContent()).toEqual("testytest");
-            });
+        // start after saving the private key
+        await aliceClient.startClient();
+
+        // tell Alice to trust the dummy device that signed the backup, and re-check the backup.
+        // XXX: should we automatically re-check after a device becomes verified?
+        await waitForDeviceList();
+        await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+        await aliceClient.checkKeyBackup();
+
+        // Now, send Alice a message that she won't be able to decrypt, and check that she fetches the key from the backup.
+        syncResponder.sendOrQueueSyncResponse(syncResponse);
+        await syncPromise(aliceClient);
+
+        const room = aliceClient.getRoom(ROOM_ID)!;
+        const event = room.getLiveTimeline().getEvents()[0];
+        await awaitDecryption(event, { waitOnDecryptionFailure: true });
+        expect(event.getContent()).toEqual("testytest");
    });
+
+    oldBackendOnly("getActiveSessionBackupVersion() should give correct result", async function () {
+        // 404 means that there is no active backup
+        fetchMock.get("express:/_matrix/client/v3/room_keys/version", 404);
+
+        aliceClient = await initTestClient();
+        const aliceCrypto = aliceClient.getCrypto()!;
+        await aliceClient.startClient();
+
+        // tell Alice to trust the dummy device that signed the backup
+        await waitForDeviceList();
+        await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+        await aliceClient.checkKeyBackup();
+
+        // At this point there is no backup
+        let backupStatus: string | null;
+        backupStatus = await aliceCrypto.getActiveSessionBackupVersion();
+        expect(backupStatus).toBeNull();
+
+        // Serve a backup with no trusted signature
+        const unsignedBackup = JSON.parse(JSON.stringify(testData.SIGNED_BACKUP_DATA));
+        delete unsignedBackup.auth_data.signatures;
+        fetchMock.get("express:/_matrix/client/v3/room_keys/version", unsignedBackup, {
+            overwriteRoutes: true,
+        });
+
+        const checked = await aliceClient.checkKeyBackup();
+        expect(checked?.backupInfo?.version).toStrictEqual(unsignedBackup.version);
+        expect(checked?.trustInfo?.usable).toBeFalsy();
+
+        backupStatus = await aliceCrypto.getActiveSessionBackupVersion();
+        expect(backupStatus).toBeNull();
+
+        // Add a valid signature to the backup
+        fetchMock.get("express:/_matrix/client/v3/room_keys/version", testData.SIGNED_BACKUP_DATA, {
+            overwriteRoutes: true,
+        });
+
+        // check that signalling is working
+        const backupPromise = new Promise<void>((resolve, reject) => {
+            aliceClient.on(CryptoEvent.KeyBackupStatus, (enabled) => {
+                if (enabled) {
+                    resolve();
+                }
+            });
+        });
+
+        const validCheck = await aliceClient.checkKeyBackup();
+        expect(validCheck?.trustInfo?.usable).toStrictEqual(true);
+
+        await backupPromise;
+
+        backupStatus = await aliceCrypto.getActiveSessionBackupVersion();
+        expect(backupStatus).toStrictEqual(testData.SIGNED_BACKUP_DATA.version);
+    });
+
+    describe("isKeyBackupTrusted", () => {
+        it("does not trust a backup signed by an untrusted device", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // download the device list, to match the trusted case
+            await aliceClient.startClient();
+            await waitForDeviceList();
+
+            const result = await aliceCrypto.isKeyBackupTrusted(testData.SIGNED_BACKUP_DATA);
+            expect(result).toEqual({ trusted: false, matchesDecryptionKey: false });
+        });
+
+        it("trusts a backup signed by a trusted device", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            // tell Alice to trust the dummy device that signed the backup
+            await aliceClient.startClient();
+            await waitForDeviceList();
+            await aliceCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            const result = await aliceCrypto.isKeyBackupTrusted(testData.SIGNED_BACKUP_DATA);
+            expect(result).toEqual({ trusted: true, matchesDecryptionKey: false });
+        });
+
+        it("recognises a backup which matches the decryption key", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            await aliceClient.startClient();
+            await aliceCrypto.storeSessionBackupPrivateKey(
+                Buffer.from(testData.BACKUP_DECRYPTION_KEY_BASE64, "base64"),
+            );
+
+            const result = await aliceCrypto.isKeyBackupTrusted(testData.SIGNED_BACKUP_DATA);
+            expect(result).toEqual({ trusted: false, matchesDecryptionKey: true });
+        });
+
+        it("is not fooled by a backup which matches the decryption key but uses a different algorithm", async () => {
+            aliceClient = await initTestClient();
+            const aliceCrypto = aliceClient.getCrypto()!;
+
+            await aliceClient.startClient();
+            await aliceCrypto.storeSessionBackupPrivateKey(
+                Buffer.from(testData.BACKUP_DECRYPTION_KEY_BASE64, "base64"),
+            );
+
+            const backup: KeyBackupInfo = JSON.parse(JSON.stringify(testData.SIGNED_BACKUP_DATA));
+            backup.algorithm = "m.megolm_backup.v1.aes-hmac-sha2";
+            const result = await aliceCrypto.isKeyBackupTrusted(backup);
+            expect(result).toEqual({ trusted: false, matchesDecryptionKey: false });
+        });
+    });
+
+    /** make sure that the client knows about the dummy device */
+    async function waitForDeviceList(): Promise<void> {
+        // Completing the initial sync will make the device list download outdated device lists (of which our own
+        // user will be one).
+        syncResponder.sendOrQueueSyncResponse({});
+        // DeviceList has a sleep(5) which we need to make happen
+        await jest.advanceTimersByTimeAsync(10);
+
+        // The client should now know about the dummy device
+        const devices = await aliceClient.getCrypto()!.getUserDeviceInfo([TEST_USER_ID]);
+        expect(devices.get(TEST_USER_ID)!.keys()).toContain(TEST_DEVICE_ID);
+    }
 });
@@ -16,9 +16,11 @@ limitations under the License.

 import "fake-indexeddb/auto";

+import anotherjson from "another-json";
 import { MockResponse } from "fetch-mock";
 import fetchMock from "fetch-mock-jest";
 import { IDBFactory } from "fake-indexeddb";
+import { createHash } from "crypto";

 import { createClient, CryptoEvent, ICreateClientOpts, MatrixClient } from "../../../src";
 import {
@@ -50,28 +52,14 @@ import { E2EKeyReceiver } from "../../test-utils/E2EKeyReceiver";
 // to ensure that we don't end up with dangling timeouts.
 jest.useFakeTimers();

-let previousCrypto: Crypto | undefined;
-
 beforeAll(async () => {
-    // Stub out global.crypto
-    previousCrypto = global["crypto"];
-
-    Object.defineProperty(global, "crypto", {
-        value: {
-            getRandomValues: function <T extends Uint8Array>(array: T): T {
-                array.fill(0x12);
-                return array;
-            },
-        },
-    });
-
    // we use the libolm primitives in the test, so init the Olm library
    await global.Olm.init();
 });

 // load the rust library. This can take a few seconds on a slow GH worker.
 beforeAll(async () => {
-    const RustSdkCryptoJs = await require("@matrix-org/matrix-sdk-crypto-js");
+    const RustSdkCryptoJs = await require("@matrix-org/matrix-sdk-crypto-wasm");
    await RustSdkCryptoJs.initAsync();
 }, 10000);

@@ -82,18 +70,6 @@ afterEach(() => {
    indexedDB = new IDBFactory();
 });

-// restore the original global.crypto
-afterAll(() => {
-    if (previousCrypto === undefined) {
-        // @ts-ignore deleting a non-optional property. It *is* optional really.
-        delete global.crypto;
-    } else {
-        Object.defineProperty(global, "crypto", {
-            value: previousCrypto,
-        });
-    }
-});
-
 /** The homeserver url that we give to the test client, and where we intercept /sync, /keys, etc requests. */
 const TEST_HOMESERVER_URL = "https://alice-server.com";

@@ -105,9 +81,9 @@ const TEST_HOMESERVER_URL = "https://alice-server.com";
 */
 // we test with both crypto stacks...
 describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: string, initCrypto: InitCrypto) => {
-    // oldBackendOnly is an alternative to `it` or `test` which will skip the test if we are running against the
-    // Rust backend. Once we have full support in the rust sdk, it will go away.
-    const oldBackendOnly = backend === "rust-sdk" ? test.skip : test;
+    // newBackendOnly is the opposite to `oldBackendOnly`: it will skip the test if we are running against the legacy
+    // backend. Once we drop support for legacy crypto, it will go away.
+    const newBackendOnly = backend === "rust-sdk" ? test : test.skip;

    /** the client under test */
    let aliceClient: MatrixClient;
@@ -148,7 +124,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
    describe("Outgoing verification requests for another device", () => {
        beforeEach(async () => {
            // pretend that we have another device, which we will verify
-            e2eKeyResponder.addDeviceKeys(TEST_USER_ID, TEST_DEVICE_ID, SIGNED_TEST_DEVICE_DATA);
+            e2eKeyResponder.addDeviceKeys(SIGNED_TEST_DEVICE_DATA);
        });

        // test with (1) the default verification method list, (2) a custom verification method list.
@@ -177,6 +153,9 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(request.chosenMethod).toBe(null); // nothing chosen yet
            expect(request.initiatedByMe).toBe(true);
            expect(request.otherUserId).toEqual(TEST_USER_ID);
+            expect(request.pending).toBe(true);
+            // we're using fake timers, so the timeout should have exactly 10 minutes left still.
+            expect(request.timeout).toEqual(600_000);

            // and now the request should be visible via `getVerificationRequestsToDeviceInProgress`
            {
@@ -185,6 +164,14 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
                expect(requests[0].transactionId).toEqual(transactionId);
            }

+            // check that the returned request depends on the given userID
+            {
+                const requests = aliceClient
+                    .getCrypto()!
+                    .getVerificationRequestsToDeviceInProgress("@unknown:localhost");
+                expect(requests.length).toEqual(0);
+            }
+
            let toDeviceMessage = requestBody.messages[TEST_USER_ID][TEST_DEVICE_ID];
            expect(toDeviceMessage.from_device).toEqual(aliceClient.deviceId);
            expect(toDeviceMessage.transaction_id).toEqual(transactionId);
@@ -235,13 +222,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            // The dummy device makes up a curve25519 keypair and sends the public bit back in an `m.key.verification.key'
            // We use the Curve25519, HMAC and HKDF implementations in libolm, for now
            const olmSAS = new global.Olm.SAS();
-            returnToDeviceMessageFromSync({
-                type: "m.key.verification.key",
-                content: {
-                    transaction_id: transactionId,
-                    key: olmSAS.get_pubkey(),
-                },
-            });
+            returnToDeviceMessageFromSync(buildSasKeyMessage(transactionId, olmSAS.get_pubkey()));

            // alice responds with a 'key' ...
            requestBody = await expectSendToDeviceMessage("m.key.verification.key");
@@ -265,36 +246,20 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(toDeviceMessage.transaction_id).toEqual(transactionId);

            // the dummy device also confirms that the emoji match, and sends a mac
-            const macInfoBase = `MATRIX_KEY_VERIFICATION_MAC${TEST_USER_ID}${TEST_DEVICE_ID}${TEST_USER_ID}${aliceClient.deviceId}${transactionId}`;
-            returnToDeviceMessageFromSync({
-                type: "m.key.verification.mac",
-                content: {
-                    keys: calculateMAC(olmSAS, `ed25519:${TEST_DEVICE_ID}`, `${macInfoBase}KEY_IDS`),
-                    transaction_id: transactionId,
-                    mac: {
-                        [`ed25519:${TEST_DEVICE_ID}`]: calculateMAC(
-                            olmSAS,
-                            TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64,
-                            `${macInfoBase}ed25519:${TEST_DEVICE_ID}`,
-                        ),
-                    },
-                },
-            });
+            returnToDeviceMessageFromSync(
+                buildSasMacMessage(transactionId, olmSAS, TEST_USER_ID, aliceClient.deviceId!),
+            );

            // that should satisfy Alice, who should reply with a 'done'
            await expectSendToDeviceMessage("m.key.verification.done");

            // the dummy device also confirms done-ness
-            returnToDeviceMessageFromSync({
-                type: "m.key.verification.done",
-                content: {
-                    transaction_id: transactionId,
-                },
-            });
+            returnToDeviceMessageFromSync(buildDoneMessage(transactionId));

            // ... and the whole thing should be done!
            await verificationPromise;
            expect(request.phase).toEqual(VerificationPhase.Done);
+            expect(request.pending).toBe(false);

            // at this point, cancelling should do nothing.
            await request.cancel();
@@ -304,6 +269,102 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            olmSAS.free();
        });

+        it("can initiate SAS verification ourselves", async () => {
+            aliceClient = await startTestClient();
+            await waitForDeviceList();
+
+            // Alice sends a m.key.verification.request
+            const [, request] = await Promise.all([
+                expectSendToDeviceMessage("m.key.verification.request"),
+                aliceClient.getCrypto()!.requestDeviceVerification(TEST_USER_ID, TEST_DEVICE_ID),
+            ]);
+            const transactionId = request.transactionId!;
+
+            // The dummy device replies with an m.key.verification.ready
+            returnToDeviceMessageFromSync(buildReadyMessage(transactionId, ["m.sas.v1"]));
+            await waitForVerificationRequestChanged(request);
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+            expect(request.otherPartySupportsMethod("m.sas.v1")).toBe(true);
+
+            // advance the clock, because the devicelist likes to sleep for 5ms during key downloads
+            await jest.advanceTimersByTimeAsync(10);
+
+            // And now Alice starts a SAS verification
+            let sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.start");
+            await request.startVerification("m.sas.v1");
+            let requestBody = await sendToDevicePromise;
+
+            let toDeviceMessage = requestBody.messages[TEST_USER_ID][TEST_DEVICE_ID];
+            expect(toDeviceMessage).toEqual({
+                from_device: aliceClient.deviceId,
+                method: "m.sas.v1",
+                transaction_id: transactionId,
+                hashes: ["sha256"],
+                key_agreement_protocols: expect.arrayContaining(["curve25519-hkdf-sha256"]),
+                message_authentication_codes: expect.arrayContaining(["hkdf-hmac-sha256.v2"]),
+                short_authentication_string: ["decimal", "emoji"],
+            });
+
+            expect(request.chosenMethod).toEqual("m.sas.v1");
+
+            // There should now be a `verifier`
+            const verifier: Verifier = request.verifier!;
+            expect(verifier).toBeDefined();
+            expect(verifier.getShowSasCallbacks()).toBeNull();
+            const verificationPromise = verifier.verify();
+
+            // The dummy device makes up a curve25519 keypair and uses the hash in an 'm.key.verification.accept'
+            // We use the Curve25519, HMAC and HKDF implementations in libolm, for now
+            const olmSAS = new global.Olm.SAS();
+            const commitmentStr = olmSAS.get_pubkey() + anotherjson.stringify(toDeviceMessage);
+
+            sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.key");
+            returnToDeviceMessageFromSync(buildSasAcceptMessage(transactionId, commitmentStr));
+
+            // alice responds with a 'key' ...
+            requestBody = await sendToDevicePromise;
+
+            toDeviceMessage = requestBody.messages[TEST_USER_ID][TEST_DEVICE_ID];
+            expect(toDeviceMessage.transaction_id).toEqual(transactionId);
+            const aliceDevicePubKeyBase64 = toDeviceMessage.key;
+            olmSAS.set_their_key(aliceDevicePubKeyBase64);
+
+            // ... and the dummy device also sends a 'key'
+            returnToDeviceMessageFromSync(buildSasKeyMessage(transactionId, olmSAS.get_pubkey()));
+
+            // ... and the client is notified to show the emoji
+            const showSas = await new Promise<ShowSasCallbacks>((resolve) => {
+                verifier.once(VerifierEvent.ShowSas, resolve);
+            });
+
+            // `getShowSasCallbacks` is an alternative way to get the callbacks
+            expect(verifier.getShowSasCallbacks()).toBe(showSas);
+            expect(verifier.getReciprocateQrCodeCallbacks()).toBeNull();
+
+            // user confirms that the emoji match, and alice sends a 'mac'
+            [requestBody] = await Promise.all([expectSendToDeviceMessage("m.key.verification.mac"), showSas.confirm()]);
+            toDeviceMessage = requestBody.messages[TEST_USER_ID][TEST_DEVICE_ID];
+            expect(toDeviceMessage.transaction_id).toEqual(transactionId);
+
+            // the dummy device also confirms that the emoji match, and sends a mac
+            returnToDeviceMessageFromSync(
+                buildSasMacMessage(transactionId, olmSAS, TEST_USER_ID, aliceClient.deviceId!),
+            );
+
+            // that should satisfy Alice, who should reply with a 'done'
+            await expectSendToDeviceMessage("m.key.verification.done");
+
+            // the dummy device also confirms done-ness
+            returnToDeviceMessageFromSync(buildDoneMessage(transactionId));
+
+            // ... and the whole thing should be done!
+            await verificationPromise;
+            expect(request.phase).toEqual(VerificationPhase.Done);
+
+            // we're done with the temporary keypair
+            olmSAS.free();
+        });
+
        it("Can make a verification request to *all* devices", async () => {
            aliceClient = await startTestClient();
            // we need an existing cross-signing key for this
@@ -334,12 +395,11 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(toDeviceMessage.transaction_id).toEqual(transactionId);
        });

-        oldBackendOnly("can verify another via QR code with an untrusted cross-signing key", async () => {
+        it("can verify another via QR code with an untrusted cross-signing key", async () => {
            aliceClient = await startTestClient();
            // QRCode fails if we don't yet have the cross-signing keys, so make sure we have them now.
            e2eKeyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);
            await waitForDeviceList();
-            expect(aliceClient.getStoredCrossSigningForUser(TEST_USER_ID)).toBeTruthy();

            // have alice initiate a verification. She should send a m.key.verification.request
            const [requestBody, request] = await Promise.all([
@@ -361,7 +421,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(request.phase).toEqual(VerificationPhase.Ready);

            // we should now have QR data we can display
-            const qrCodeBuffer = request.getQRCodeBytes()!;
+            const qrCodeBuffer = (await request.generateQRCode())!;
            expect(qrCodeBuffer).toBeTruthy();

            // https://spec.matrix.org/v1.7/client-server-api/#qr-code-format
@@ -377,16 +437,12 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            );
            const sharedSecret = qrCodeBuffer.subarray(74 + txnIdLen);

+            // we should still be "Ready" and have no verifier
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+            expect(request.verifier).toBeUndefined();
+
            // the dummy device "scans" the displayed QR code and acknowledges it with a "m.key.verification.start"
-            returnToDeviceMessageFromSync({
-                type: "m.key.verification.start",
-                content: {
-                    from_device: TEST_DEVICE_ID,
-                    method: "m.reciprocate.v1",
-                    transaction_id: transactionId,
-                    secret: encodeUnpaddedBase64(sharedSecret),
-                },
-            });
+            returnToDeviceMessageFromSync(buildReciprocateStartMessage(transactionId, sharedSecret));
            await waitForVerificationRequestChanged(request);
            expect(request.phase).toEqual(VerificationPhase.Started);
            expect(request.chosenMethod).toEqual("m.reciprocate.v1");
@@ -394,34 +450,184 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            // there should now be a verifier
            const verifier: Verifier = request.verifier!;
            expect(verifier).toBeDefined();
-            expect(verifier.getReciprocateQrCodeCallbacks()).toBeNull();

            // ... which we call .verify on, which emits a ShowReciprocateQr event
-            const verificationPromise = verifier.verify();
-            const reciprocateQRCodeCallbacks = await new Promise<ShowQrCodeCallbacks>((resolve) => {
+            const reciprocatePromise = new Promise<ShowQrCodeCallbacks>((resolve) => {
                verifier.once(VerifierEvent.ShowReciprocateQr, resolve);
            });
+            const verificationPromise = verifier.verify();
+            const reciprocateQRCodeCallbacks = await reciprocatePromise;

            // getReciprocateQrCodeCallbacks() is an alternative way to get the callbacks
            expect(verifier.getReciprocateQrCodeCallbacks()).toBe(reciprocateQRCodeCallbacks);
            expect(verifier.getShowSasCallbacks()).toBeNull();

-            // Alice confirms she is happy
+            // Alice confirms she is happy, which makes her reply with a 'done'
+            const sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.done");
            reciprocateQRCodeCallbacks.confirm();
+            await sendToDevicePromise;

-            // that should satisfy Alice, who should reply with a 'done'
+            // the dummy device replies with its own 'done'
+            returnToDeviceMessageFromSync(buildDoneMessage(transactionId));
+
+            // ... and the whole thing should be done!
+            await verificationPromise;
+            expect(request.phase).toEqual(VerificationPhase.Done);
+        });
+
+        newBackendOnly("can verify another by scanning their QR code", async () => {
+            aliceClient = await startTestClient();
+            // we need cross-signing keys for a QR code verification
+            e2eKeyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);
+            await waitForDeviceList();
+
+            // Alice sends a m.key.verification.request
+            const [, request] = await Promise.all([
+                expectSendToDeviceMessage("m.key.verification.request"),
+                aliceClient.getCrypto()!.requestDeviceVerification(TEST_USER_ID, TEST_DEVICE_ID),
+            ]);
+            const transactionId = request.transactionId!;
+
+            // The dummy device replies with an m.key.verification.ready, indicating it can show a QR code
+            returnToDeviceMessageFromSync(buildReadyMessage(transactionId, ["m.qr_code.show.v1", "m.reciprocate.v1"]));
+            await waitForVerificationRequestChanged(request);
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+            expect(request.otherPartySupportsMethod("m.qr_code.show.v1")).toBe(true);
+
+            // the dummy device shows a QR code
+            const sharedSecret = "SUPERSEKRET";
+            const qrCodeBuffer = buildQRCode(
+                transactionId,
+                TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64,
+                MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64,
+                sharedSecret,
+            );
+
+            // Alice scans the QR code
+            const sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.start");
+            const verifier = await request.scanQRCode(qrCodeBuffer);
+
+            const requestBody = await sendToDevicePromise;
+            const toDeviceMessage = requestBody.messages[TEST_USER_ID][TEST_DEVICE_ID];
+            expect(toDeviceMessage).toEqual({
+                from_device: aliceClient.deviceId,
+                method: "m.reciprocate.v1",
+                transaction_id: transactionId,
+                secret: encodeUnpaddedBase64(Buffer.from(sharedSecret)),
+            });
+
+            expect(request.phase).toEqual(VerificationPhase.Started);
+            expect(request.chosenMethod).toEqual("m.reciprocate.v1");
+            expect(verifier.getReciprocateQrCodeCallbacks()).toBeNull();
+
+            const verificationPromise = verifier.verify();
+
+            // the dummy device confirms that Alice scanned the QR code, by replying with a done
+            returnToDeviceMessageFromSync(buildDoneMessage(transactionId));
+
+            // Alice also replies with a 'done'
            await expectSendToDeviceMessage("m.key.verification.done");

            // ... and the whole thing should be done!
            await verificationPromise;
            expect(request.phase).toEqual(VerificationPhase.Done);
        });
+
+        it("can send an SAS start after QR code display", async () => {
+            aliceClient = await startTestClient();
+            e2eKeyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);
+            await waitForDeviceList();
+
+            // Alice sends a m.key.verification.request
+            const [, request] = await Promise.all([
+                expectSendToDeviceMessage("m.key.verification.request"),
+                aliceClient.getCrypto()!.requestDeviceVerification(TEST_USER_ID, TEST_DEVICE_ID),
+            ]);
+            const transactionId = request.transactionId!;
+
+            // The dummy device replies with an m.key.verification.ready, with an indication it can scan a QR code
+            // or do the emoji dance
+            returnToDeviceMessageFromSync(
+                buildReadyMessage(transactionId, ["m.qr_code.scan.v1", "m.sas.v1", "m.reciprocate.v1"]),
+            );
+            await waitForVerificationRequestChanged(request);
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+
+            // Alice displays the QR code
+            const qrCodeBuffer = (await request.generateQRCode())!;
+            expect(qrCodeBuffer).toBeTruthy();
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+            expect(request.verifier).toBeUndefined();
+
+            // advance the clock, because the devicelist likes to sleep for 5ms during key downloads
+            await jest.advanceTimersByTimeAsync(10);
+
+            // ... but Alice wants to do an SAS verification
+            const sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.start");
+            await request.startVerification("m.sas.v1");
+            await sendToDevicePromise;
+
+            // There should now be a `verifier`
+            const verifier: Verifier = request.verifier!;
+            expect(verifier).toBeDefined();
+            expect(request.chosenMethod).toEqual("m.sas.v1");
+
+            // clean up the test
+            expectSendToDeviceMessage("m.key.verification.cancel");
+            request.cancel();
+            await expect(verifier.verify()).rejects.toBeTruthy();
+        });
+
+        it("can receive an SAS start after QR code display", async () => {
+            aliceClient = await startTestClient();
+            e2eKeyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);
+            await waitForDeviceList();
+
+            // Alice sends a m.key.verification.request
+            const [, request] = await Promise.all([
+                expectSendToDeviceMessage("m.key.verification.request"),
+                aliceClient.getCrypto()!.requestDeviceVerification(TEST_USER_ID, TEST_DEVICE_ID),
+            ]);
+            const transactionId = request.transactionId!;
+
+            // The dummy device replies with an m.key.verification.ready, with an indication it can scan a QR code
+            // or do the emoji dance
+            returnToDeviceMessageFromSync(
+                buildReadyMessage(transactionId, ["m.qr_code.scan.v1", "m.sas.v1", "m.reciprocate.v1"]),
+            );
+            await waitForVerificationRequestChanged(request);
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+
+            // Alice displays the QR code
+            const qrCodeBuffer = (await request.generateQRCode())!;
+            expect(qrCodeBuffer).toBeTruthy();
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+            expect(request.verifier).toBeUndefined();
+
+            // advance the clock, because the devicelist likes to sleep for 5ms during key downloads
+            await jest.advanceTimersByTimeAsync(10);
+
+            // ... but the dummy device wants to do an SAS verification
+            returnToDeviceMessageFromSync(buildSasStartMessage(transactionId));
+            await emitPromise(request, VerificationRequestEvent.Change);
+
+            // Alice should now have a `verifier`
+            const verifier: Verifier = request.verifier!;
+            expect(verifier).toBeDefined();
+            expect(request.chosenMethod).toEqual("m.sas.v1");
+
+            // clean up the test
+            expectSendToDeviceMessage("m.key.verification.cancel");
+            request.cancel();
+            await expect(verifier.verify()).rejects.toBeTruthy();
+        });
    });

    describe("cancellation", () => {
        beforeEach(async () => {
            // pretend that we have another device, which we will start verifying
-            e2eKeyResponder.addDeviceKeys(TEST_USER_ID, TEST_DEVICE_ID, SIGNED_TEST_DEVICE_DATA);
+            e2eKeyResponder.addDeviceKeys(SIGNED_TEST_DEVICE_DATA);
+            e2eKeyResponder.addCrossSigningData(SIGNED_CROSS_SIGNING_KEYS_DATA);

            aliceClient = await startTestClient();
            await waitForDeviceList();
@@ -489,28 +695,69 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(request.phase).toEqual(VerificationPhase.Cancelled);
            expect(verifier.hasBeenCancelled).toBe(true);
        });
+
+        it("can cancel in the ShowQrCodeCallbacks", async () => {
+            // have alice initiate a verification. She should send a m.key.verification.request
+            const [, request] = await Promise.all([
+                expectSendToDeviceMessage("m.key.verification.request"),
+                aliceClient.getCrypto()!.requestDeviceVerification(TEST_USER_ID, TEST_DEVICE_ID),
+            ]);
+            const transactionId = request.transactionId!;
+
+            // The dummy device replies with an m.key.verification.ready, with an indication it can scan the QR code
+            returnToDeviceMessageFromSync(buildReadyMessage(transactionId, ["m.qr_code.scan.v1"]));
+            await waitForVerificationRequestChanged(request);
+            expect(request.phase).toEqual(VerificationPhase.Ready);
+
+            // we should now have QR data we can display
+            const qrCodeBuffer = (await request.generateQRCode())!;
+            expect(qrCodeBuffer).toBeTruthy();
+            const sharedSecret = qrCodeBuffer.subarray(74 + transactionId.length);
+
+            // the dummy device "scans" the displayed QR code and acknowledges it with a "m.key.verification.start"
+            returnToDeviceMessageFromSync(buildReciprocateStartMessage(transactionId, sharedSecret));
+            await waitForVerificationRequestChanged(request);
+            expect(request.phase).toEqual(VerificationPhase.Started);
+            expect(request.chosenMethod).toEqual("m.reciprocate.v1");
+
+            // there should now be a verifier
+            const verifier: Verifier = request.verifier!;
+            expect(verifier).toBeDefined();
+
+            // ... which we call .verify on, which emits a ShowReciprocateQr event
+            const reciprocatePromise = emitPromise(verifier, VerifierEvent.ShowReciprocateQr);
+            const verificationPromise = verifier.verify();
+            const reciprocateQRCodeCallbacks: ShowQrCodeCallbacks = await reciprocatePromise;
+
+            // Alice complains that she didn't see the dummy device scan her code
+            const sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.cancel");
+            reciprocateQRCodeCallbacks.cancel();
+            await sendToDevicePromise;
+
+            // ... which should cancel the verifier
+            await expect(verificationPromise).rejects.toBeTruthy();
+            expect(request.phase).toEqual(VerificationPhase.Cancelled);
+            expect(verifier.hasBeenCancelled).toBe(true);
+        });
    });

    describe("Incoming verification from another device", () => {
-        beforeEach(() => {
-            e2eKeyResponder.addDeviceKeys(TEST_USER_ID, TEST_DEVICE_ID, SIGNED_TEST_DEVICE_DATA);
+        beforeEach(async () => {
+            e2eKeyResponder.addDeviceKeys(SIGNED_TEST_DEVICE_DATA);
+
+            aliceClient = await startTestClient();
+            await waitForDeviceList();
        });

-        oldBackendOnly("Incoming verification: can accept", async () => {
-            aliceClient = await startTestClient();
+        it("Incoming verification: can accept", async () => {
            const TRANSACTION_ID = "abcd";

            // Initiate the request by sending a to-device message
-            returnToDeviceMessageFromSync({
-                type: "m.key.verification.request",
-                content: {
-                    from_device: TEST_DEVICE_ID,
-                    methods: ["m.sas.v1"],
-                    transaction_id: TRANSACTION_ID,
-                    timestamp: Date.now() - 1000,
-                },
-            });
-            const request: VerificationRequest = await emitPromise(aliceClient, CryptoEvent.VerificationRequest);
+            returnToDeviceMessageFromSync(buildRequestMessage(TRANSACTION_ID));
+            const request: VerificationRequest = await emitPromise(
+                aliceClient,
+                CryptoEvent.VerificationRequestReceived,
+            );
            expect(request.transactionId).toEqual(TRANSACTION_ID);
            expect(request.phase).toEqual(VerificationPhase.Requested);
            expect(request.roomId).toBeUndefined();
@@ -518,6 +765,7 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(request.otherUserId).toEqual(TEST_USER_ID);
            expect(request.chosenMethod).toBe(null); // nothing chosen yet
            expect(canAcceptVerificationRequest(request)).toBe(true);
+            expect(request.pending).toBe(true);

            // Alice accepts, by sending a to-device message
            const sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.ready");
@@ -533,6 +781,31 @@ describe.each(Object.entries(CRYPTO_BACKENDS))("verification (%s)", (backend: st
            expect(toDeviceMessage.from_device).toEqual(aliceClient.deviceId);
            expect(toDeviceMessage.transaction_id).toEqual(TRANSACTION_ID);
        });
+
+        it("Incoming verification: can refuse", async () => {
+            const TRANSACTION_ID = "abcd";
+
+            // Initiate the request by sending a to-device message
+            returnToDeviceMessageFromSync(buildRequestMessage(TRANSACTION_ID));
+            const request: VerificationRequest = await emitPromise(
+                aliceClient,
+                CryptoEvent.VerificationRequestReceived,
+            );
+            expect(request.transactionId).toEqual(TRANSACTION_ID);
+
+            // Alice declines, by sending a cancellation
+            const sendToDevicePromise = expectSendToDeviceMessage("m.key.verification.cancel");
+            const cancelPromise = request.cancel();
+            expect(canAcceptVerificationRequest(request)).toBe(false);
+            expect(request.accepting).toBe(false);
+            expect(request.declining).toBe(true);
+            await cancelPromise;
+            const requestBody = await sendToDevicePromise;
+            expect(request.phase).toEqual(VerificationPhase.Cancelled);
+
+            const toDeviceMessage = requestBody.messages[TEST_USER_ID][TEST_DEVICE_ID];
+            expect(toDeviceMessage.transaction_id).toEqual(TRANSACTION_ID);
+        });
    });

    async function startTestClient(opts: Partial<ICreateClientOpts> = {}): Promise<MatrixClient> {
@@ -607,10 +880,28 @@ function calculateMAC(olmSAS: Olm.SAS, input: string, info: string): string {
    return mac;
 }

+/** Calculate the sha256 hash of a string, encoding as unpadded base64 */
+function sha256(commitmentStr: string): string {
+    return encodeUnpaddedBase64(createHash("sha256").update(commitmentStr, "utf8").digest());
+}
+
 function encodeUnpaddedBase64(uint8Array: ArrayBuffer | Uint8Array): string {
    return Buffer.from(uint8Array).toString("base64").replace(/=+$/g, "");
 }

+/** build an m.key.verification.request to-device message originating from the dummy device */
+function buildRequestMessage(transactionId: string): { type: string; content: object } {
+    return {
+        type: "m.key.verification.request",
+        content: {
+            from_device: TEST_DEVICE_ID,
+            methods: ["m.sas.v1"],
+            transaction_id: transactionId,
+            timestamp: Date.now() - 1000,
+        },
+    };
+}
+
 /** build an m.key.verification.ready to-device message originating from the dummy device */
 function buildReadyMessage(transactionId: string, methods: string[]): { type: string; content: object } {
    return {
@@ -623,6 +914,19 @@ function buildReadyMessage(transactionId: string, methods: string[]): { type: st
    };
 }

+/** build an m.key.verification.start to-device message suitable for the m.reciprocate.v1 flow, originating from the dummy device */
+function buildReciprocateStartMessage(transactionId: string, sharedSecret: Uint8Array) {
+    return {
+        type: "m.key.verification.start",
+        content: {
+            from_device: TEST_DEVICE_ID,
+            method: "m.reciprocate.v1",
+            transaction_id: transactionId,
+            secret: encodeUnpaddedBase64(sharedSecret),
+        },
+    };
+}
+
 /** build an m.key.verification.start to-device message suitable for the SAS flow, originating from the dummy device */
 function buildSasStartMessage(transactionId: string): { type: string; content: object } {
    return {
@@ -639,3 +943,83 @@ function buildSasStartMessage(transactionId: string): { type: string; content: o
        },
    };
 }
+
+/** build an m.key.verification.accept to-device message suitable for the SAS flow */
+function buildSasAcceptMessage(transactionId: string, commitmentStr: string) {
+    return {
+        type: "m.key.verification.accept",
+        content: {
+            transaction_id: transactionId,
+            commitment: sha256(commitmentStr),
+            hash: "sha256",
+            key_agreement_protocol: "curve25519-hkdf-sha256",
+            short_authentication_string: ["decimal", "emoji"],
+            message_authentication_code: "hkdf-hmac-sha256.v2",
+        },
+    };
+}
+
+/** build an m.key.verification.key to-device message suitable for the SAS flow */
+function buildSasKeyMessage(transactionId: string, key: string): { type: string; content: object } {
+    return {
+        type: "m.key.verification.key",
+        content: {
+            transaction_id: transactionId,
+            key: key,
+        },
+    };
+}
+
+/** build an m.key.verification.mac to-device message suitable for the SAS flow, originating from the dummy device */
+function buildSasMacMessage(
+    transactionId: string,
+    olmSAS: Olm.SAS,
+    recipientUserId: string,
+    recipientDeviceId: string,
+): { type: string; content: object } {
+    const macInfoBase = `MATRIX_KEY_VERIFICATION_MAC${TEST_USER_ID}${TEST_DEVICE_ID}${recipientUserId}${recipientDeviceId}${transactionId}`;
+
+    return {
+        type: "m.key.verification.mac",
+        content: {
+            keys: calculateMAC(olmSAS, `ed25519:${TEST_DEVICE_ID}`, `${macInfoBase}KEY_IDS`),
+            transaction_id: transactionId,
+            mac: {
+                [`ed25519:${TEST_DEVICE_ID}`]: calculateMAC(
+                    olmSAS,
+                    TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64,
+                    `${macInfoBase}ed25519:${TEST_DEVICE_ID}`,
+                ),
+            },
+        },
+    };
+}
+
+/** build an m.key.verification.done to-device message */
+function buildDoneMessage(transactionId: string) {
+    return {
+        type: "m.key.verification.done",
+        content: {
+            transaction_id: transactionId,
+        },
+    };
+}
+
+function buildQRCode(transactionId: string, key1Base64: string, key2Base64: string, sharedSecret: string): Uint8Array {
+    // https://spec.matrix.org/v1.7/client-server-api/#qr-code-format
+
+    const qrCodeBuffer = Buffer.alloc(150); // oversize
+    let idx = 0;
+    idx += qrCodeBuffer.write("MATRIX", idx, "ascii");
+    idx = qrCodeBuffer.writeUInt8(0x02, idx); // version
+    idx = qrCodeBuffer.writeUInt8(0x02, idx); // mode
+    idx = qrCodeBuffer.writeInt16BE(transactionId.length, idx);
+    idx += qrCodeBuffer.write(transactionId, idx, "ascii");
+
+    idx += Buffer.from(key1Base64, "base64").copy(qrCodeBuffer, idx);
+    idx += Buffer.from(key2Base64, "base64").copy(qrCodeBuffer, idx);
+    idx += qrCodeBuffer.write(sharedSecret, idx);
+
+    // truncate to the right length
+    return qrCodeBuffer.subarray(0, idx);
+}
@@ -207,7 +207,7 @@ function startClient(httpBackend: HttpBackend, client: MatrixClient) {
    httpBackend.when("POST", "/filter").respond(200, { filter_id: "fid" });
    httpBackend.when("GET", "/sync").respond(200, INITIAL_SYNC_DATA);

-    client.startClient();
+    client.startClient({ threadSupport: true });

    // set up a promise which will resolve once the client is initialised
    const prom = new Promise<void>((resolve) => {
@@ -248,7 +248,7 @@ describe("getEventTimeline support", function () {
        return startClient(httpBackend, client).then(function () {
            const room = client.getRoom(roomId)!;
            const timelineSet = room!.getTimelineSets()[0];
-            expect(client.getEventTimeline(timelineSet, "event")).rejects.toBeTruthy();
+            return expect(client.getEventTimeline(timelineSet, "event")).rejects.toBeTruthy();
        });
    });

@@ -260,7 +260,18 @@ describe("getEventTimeline support", function () {
        return startClient(httpBackend, client).then(() => {
            const room = client.getRoom(roomId)!;
            const timelineSet = room!.getTimelineSets()[0];
-            expect(client.getEventTimeline(timelineSet, "event")).rejects.toBeFalsy();
+            httpBackend.when("GET", `/rooms/${encodeURIComponent(roomId)}/context/event`).respond(200, () => ({
+                event: {
+                    event_id: "event",
+                },
+                events_after: [],
+                events_before: [],
+                state: [],
+            }));
+            return Promise.all([
+                expect(client.getEventTimeline(timelineSet, "event")).resolves.toBeTruthy(),
+                httpBackend.flushAllExpected(),
+            ]);
        });
    });

@@ -271,7 +282,7 @@ describe("getEventTimeline support", function () {

        return startClient(httpBackend, client).then(function () {
            const timelineSet = new EventTimelineSet(undefined);
-            expect(client.getEventTimeline(timelineSet, "event")).rejects.toBeTruthy();
+            return expect(client.getEventTimeline(timelineSet, "event")).rejects.toBeTruthy();
        });
    });

@@ -598,12 +609,6 @@ describe("MatrixClient event timelines", function () {
            await client.stopClient(); // we don't need the client to be syncing at this time
            const room = client.getRoom(roomId)!;

-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return THREAD_ROOT;
-                });
-
            httpBackend
                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
                .respond(200, function () {
@@ -634,12 +639,6 @@ describe("MatrixClient event timelines", function () {
            const thread = room.createThread(THREAD_ROOT.event_id!, undefined, [], false);
            await httpBackend.flushAllExpected();
            const timelineSet = thread.timelineSet;
-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return THREAD_ROOT;
-                });
-            await flushHttp(emitPromise(thread, ThreadEvent.Update));

            const timeline = await client.getEventTimeline(timelineSet, THREAD_REPLY.event_id!);

@@ -790,7 +789,18 @@ describe("MatrixClient event timelines", function () {
            return startClient(httpBackend, client).then(() => {
                const room = client.getRoom(roomId)!;
                const timelineSet = room.getTimelineSets()[0];
-                expect(client.getLatestTimeline(timelineSet)).rejects.toBeFalsy();
+                httpBackend.when("GET", `/rooms/${encodeURIComponent(roomId)}/context/event`).respond(200, () => ({
+                    event: {
+                        event_id: "event",
+                    },
+                    events_after: [],
+                    events_before: [],
+                    state: [],
+                }));
+                return Promise.all([
+                    expect(client.getEventTimeline(timelineSet, "event")).resolves.toBeTruthy(),
+                    httpBackend.flushAllExpected(),
+                ]);
            });
        });

@@ -1274,7 +1284,6 @@ describe("MatrixClient event timelines", function () {
            THREAD_ROOT.event_id,
            THREAD_REPLY.event_id,
            THREAD_REPLY2.getId(),
-            THREAD_ROOT_REACTION.getId(),
            THREAD_REPLY3.getId(),
        ]);
    });
@@ -1510,7 +1519,8 @@ describe("MatrixClient event timelines", function () {
                    },
                    event: true,
                });
-                THREAD_REPLY2.localTimestamp += 1000;
+                // this has to come after THREAD_REPLY which hasn't been instantiated by us
+                THREAD_REPLY2.localTimestamp += 10000000;

                // Test data for the first thread, with the second reply
                const THREAD_ROOT_UPDATED = {
@@ -1570,9 +1580,6 @@ describe("MatrixClient event timelines", function () {
                thread.initialEventsFetched = true;
                const prom = emitPromise(room, ThreadEvent.NewReply);
                respondToEvent(THREAD_ROOT_UPDATED);
-                respondToEvent(THREAD_ROOT_UPDATED);
-                respondToEvent(THREAD_ROOT_UPDATED);
-                respondToEvent(THREAD_ROOT_UPDATED);
                respondToEvent(THREAD2_ROOT);
                await room.addLiveEvents([THREAD_REPLY2]);
                await httpBackend.flushAllExpected();
@@ -1699,13 +1706,11 @@ describe("MatrixClient event timelines", function () {
                thread.initialEventsFetched = true;
                const prom = emitPromise(room, ThreadEvent.Update);
                respondToEvent(THREAD_ROOT_UPDATED);
-                respondToEvent(THREAD_ROOT_UPDATED);
-                respondToEvent(THREAD_ROOT_UPDATED);
                respondToEvent(THREAD2_ROOT);
                await room.addLiveEvents([THREAD_REPLY_REACTION]);
                await httpBackend.flushAllExpected();
                await prom;
-                expect(thread.length).toBe(2);
+                expect(thread.length).toBe(1); // reactions don't count towards the length of a thread
                // Test thread order is unchanged
                expect(timeline!.getEvents().map((it) => it.event.event_id)).toEqual([
                    THREAD_ROOT.event_id,
@@ -2047,71 +2052,7 @@ describe("MatrixClient event timelines", function () {
            expect(thread.initialEventsFetched).toBeTruthy();
            const timelineSet = thread.timelineSet;

-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return THREAD_ROOT;
-                });
-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return THREAD_ROOT;
-                });
-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return THREAD_ROOT;
-                });
-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/event/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return THREAD_ROOT;
-                });
-            httpBackend
-                .when("GET", "/rooms/!foo%3Abar/context/" + encodeURIComponent(THREAD_ROOT.event_id!))
-                .respond(200, function () {
-                    return {
-                        start: "start_token",
-                        events_before: [],
-                        event: THREAD_ROOT,
-                        events_after: [],
-                        end: "end_token",
-                        state: [],
-                    };
-                });
-            httpBackend
-                .when(
-                    "GET",
-                    "/_matrix/client/v1/rooms/!foo%3Abar/relations/" +
-                        encodeURIComponent(THREAD_ROOT.event_id!) +
-                        "/" +
-                        encodeURIComponent(THREAD_RELATION_TYPE.name) +
-                        buildRelationPaginationQuery({
-                            dir: Direction.Backward,
-                            from: "start_token",
-                        }),
-                )
-                .respond(200, function () {
-                    return {
-                        chunk: [],
-                    };
-                });
-            httpBackend
-                .when(
-                    "GET",
-                    "/_matrix/client/v1/rooms/!foo%3Abar/relations/" +
-                        encodeURIComponent(THREAD_ROOT.event_id!) +
-                        "/" +
-                        encodeURIComponent(THREAD_RELATION_TYPE.name) +
-                        buildRelationPaginationQuery({ dir: Direction.Forward, from: "end_token" }),
-                )
-                .respond(200, function () {
-                    return {
-                        chunk: [THREAD_REPLY],
-                    };
-                });
-
-            const timeline = await flushHttp(client.getEventTimeline(timelineSet, THREAD_ROOT.event_id!));
+            const timeline = await client.getEventTimeline(timelineSet, THREAD_ROOT.event_id!);

            httpBackend.when("GET", "/sync").respond(200, {
                next_batch: "s_5_5",
@@ -38,6 +38,7 @@ import {
    Room,
    IndexedDBStore,
    RelationType,
+    EventType,
 } from "../../src";
 import { ReceiptType } from "../../src/@types/read_receipts";
 import { UNREAD_THREAD_NOTIFICATIONS } from "../../src/@types/sync";
@@ -1590,6 +1591,68 @@ describe("MatrixClient syncing", () => {
                });
            });
        });
+
+        it("should apply encrypted notification logic for events within the same sync blob", async () => {
+            const roomId = "!room123:server";
+            const syncData = {
+                rooms: {
+                    join: {
+                        [roomId]: {
+                            ephemeral: {
+                                events: [],
+                            },
+                            timeline: {
+                                events: [
+                                    utils.mkEvent({
+                                        room: roomId,
+                                        event: true,
+                                        skey: "",
+                                        type: EventType.RoomEncryption,
+                                        content: {},
+                                    }),
+                                    utils.mkMessage({
+                                        room: roomId,
+                                        user: otherUserId,
+                                        msg: "hello",
+                                    }),
+                                ],
+                            },
+                            state: {
+                                events: [
+                                    utils.mkMembership({
+                                        room: roomId,
+                                        mship: "join",
+                                        user: otherUserId,
+                                    }),
+                                    utils.mkMembership({
+                                        room: roomId,
+                                        mship: "join",
+                                        user: selfUserId,
+                                    }),
+                                    utils.mkEvent({
+                                        type: "m.room.create",
+                                        room: roomId,
+                                        user: selfUserId,
+                                        content: {
+                                            creator: selfUserId,
+                                        },
+                                    }),
+                                ],
+                            },
+                        },
+                    },
+                },
+            } as unknown as ISyncResponse;
+
+            httpBackend!.when("GET", "/sync").respond(200, syncData);
+            client!.startClient();
+
+            await Promise.all([httpBackend!.flushAllExpected(), awaitSyncEvent()]);
+
+            const room = client!.getRoom(roomId)!;
+            expect(room).toBeInstanceOf(Room);
+            expect(room.getRoomUnreadNotificationCount(NotificationCountType.Total)).toBe(0);
+        });
    });

    describe("of a room", () => {
@@ -1161,11 +1161,6 @@ describe("SlidingSync", () => {
            httpBackend!.when("POST", syncUrl).check(pushTxn).respond(200, { pos: "f" }); // missing txn_id
            await httpBackend!.flushAllExpected();

-            // attach rejection handlers now else if we do it later Jest treats that as an unhandled rejection
-            // which is a fail.
-            expect(failPromise).rejects.toEqual(gotTxnIds[0]);
-            expect(failPromise2).rejects.toEqual(gotTxnIds[1]);
-
            const okPromise = slidingSync.setListRanges("a", [[0, 20]]);
            let txnId: string | undefined;
            httpBackend!
@@ -1180,8 +1175,12 @@ describe("SlidingSync", () => {
                        txn_id: txnId,
                    };
                });
-            await httpBackend!.flushAllExpected();
-            await okPromise;
+            await Promise.all([
+                expect(failPromise).rejects.toEqual(gotTxnIds[0]),
+                expect(failPromise2).rejects.toEqual(gotTxnIds[1]),
+                httpBackend!.flushAllExpected(),
+                okPromise,
+            ]);

            expect(txnId).toBeDefined();
        });
@@ -1200,7 +1199,6 @@ describe("SlidingSync", () => {

            // attach rejection handlers now else if we do it later Jest treats that as an unhandled rejection
            // which is a fail.
-            expect(A).rejects.toEqual(gotTxnIds[0]);

            const C = slidingSync.setListRanges("a", [[0, 20]]);
            let pendingC = true;
@@ -1217,9 +1215,12 @@ describe("SlidingSync", () => {
                        txn_id: gotTxnIds[1],
                    };
                });
-            await httpBackend!.flushAllExpected();
-            // A is rejected, see above
-            expect(B).resolves.toEqual(gotTxnIds[1]); // B is resolved
+            await Promise.all([
+                expect(A).rejects.toEqual(gotTxnIds[0]),
+                httpBackend!.flushAllExpected(),
+                // A is rejected, see above
+                expect(B).resolves.toEqual(gotTxnIds[1]), // B is resolved
+            ]);
            expect(pendingC).toBe(true); // C is pending still
        });
        it("should do nothing for unknown txn_ids", async () => {
@@ -89,12 +89,10 @@ export class E2EKeyResponder {
    /**
     * Add a set of device keys for return by a future `/keys/query`, as if they had been `/upload`ed
     *
-     * @param userId - user the keys belong to
-     * @param deviceId - device the keys belong to
     * @param keys - device keys for this device.
     */
-    public addDeviceKeys(userId: string, deviceId: string, keys: IDeviceKeys) {
-        this.deviceKeysByUserByDevice.getOrCreate(userId).set(deviceId, keys);
+    public addDeviceKeys(keys: IDeviceKeys) {
+        this.deviceKeysByUserByDevice.getOrCreate(keys.user_id).set(keys.device_id, keys);
    }

    /** Add a set of cross-signing keys for return by a future `/keys/query`, as if they had been `/keys/device_signing/upload`ed
@@ -32,13 +32,16 @@ export function mockInitialApiRequests(homeserverUrl: string) {
 /**
 * Mock the requests needed to set up cross signing
 *
- * Return `{}` for `GET _matrix/client/r0/user/:userId/account_data/:type` request
+ * Return 404 error for `GET _matrix/client/r0/user/:userId/account_data/:type` request
 * Return `{}` for `POST _matrix/client/v3/keys/signatures/upload` request (named `upload-sigs` for fetchMock check)
 * Return `{}` for `POST /_matrix/client/(unstable|v3)/keys/device_signing/upload` request (named `upload-keys` for fetchMock check)
 */
 export function mockSetupCrossSigningRequests(): void {
    // have account_data requests return an empty object
-    fetchMock.get("express:/_matrix/client/r0/user/:userId/account_data/:type", {});
+    fetchMock.get("express:/_matrix/client/r0/user/:userId/account_data/:type", {
+        status: 404,
+        body: { errcode: "M_NOT_FOUND", error: "Account data not found." },
+    });

    // we expect a request to upload signatures for our device ...
    fetchMock.post({ url: "path:/_matrix/client/v3/keys/signatures/upload", name: "upload-sigs" }, {});
@@ -0,0 +1,53 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { OidcClientConfig } from "../../src";
+import { ValidatedIssuerMetadata } from "../../src/oidc/validate";
+
+/**
+ * Makes a valid OidcClientConfig with minimum valid values
+ * @param issuer used as the base for all other urls
+ * @returns OidcClientConfig
+ */
+export const makeDelegatedAuthConfig = (issuer = "https://auth.org/"): OidcClientConfig => {
+    const metadata = mockOpenIdConfiguration(issuer);
+
+    return {
+        issuer,
+        account: issuer + "account",
+        registrationEndpoint: metadata.registration_endpoint,
+        authorizationEndpoint: metadata.authorization_endpoint,
+        tokenEndpoint: metadata.token_endpoint,
+        metadata,
+    };
+};
+
+/**
+ * Useful for mocking <issuer>/.well-known/openid-configuration
+ * @param issuer used as the base for all other urls
+ * @returns ValidatedIssuerMetadata
+ */
+export const mockOpenIdConfiguration = (issuer = "https://auth.org/"): ValidatedIssuerMetadata => ({
+    issuer,
+    revocation_endpoint: issuer + "revoke",
+    token_endpoint: issuer + "token",
+    authorization_endpoint: issuer + "auth",
+    registration_endpoint: issuer + "registration",
+    jwks_uri: issuer + "jwks",
+    response_types_supported: ["code"],
+    grant_types_supported: ["authorization_code", "refresh_token"],
+    code_challenge_methods_supported: ["S256"],
+});
@@ -28,12 +28,13 @@ import base64
 import json

 from canonicaljson import encode_canonical_json
-from cryptography.hazmat.primitives.asymmetric import ed25519
+from cryptography.hazmat.primitives.asymmetric import ed25519, x25519
 from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat

 # input data
 TEST_USER_ID = "@alice:localhost"
 TEST_DEVICE_ID = "test_device"
+TEST_ROOM_ID = "!room:id"
 # any 32-byte string can be an ed25519 private key.
 TEST_DEVICE_PRIVATE_KEY_BYTES = b"deadbeefdeadbeefdeadbeefdeadbeef"

@@ -41,6 +42,8 @@ MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES = b"doyouspeakwhaaaaaaaaaaaaaaaaaale"
 USER_CROSS_SIGNING_PRIVATE_KEY_BYTES = b"useruseruseruseruseruseruseruser"
 SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES = b"selfselfselfselfselfselfselfself"

+# Private key for secure key backup. There are some sessions encrypted with this key in megolm-backup.spec.ts
+B64_BACKUP_DECRYPTION_KEY = "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo="

 def main() -> None:
    private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
@@ -71,6 +74,47 @@ def main() -> None:
    b64_master_public_key = encode_base64(
        master_private_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
    )
+    b64_master_private_key = encode_base64(MASTER_CROSS_SIGNING_PRIVATE_KEY_BYTES)
+
+    self_signing_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
+        SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES
+    )
+    b64_self_signing_public_key = encode_base64(
+        self_signing_private_key.public_key().public_bytes(
+            Encoding.Raw, PublicFormat.Raw
+        )
+    )
+    b64_self_signing_private_key = encode_base64(SELF_CROSS_SIGNING_PRIVATE_KEY_BYTES)
+
+    user_signing_private_key = ed25519.Ed25519PrivateKey.from_private_bytes(
+        USER_CROSS_SIGNING_PRIVATE_KEY_BYTES
+    )
+    b64_user_signing_public_key = encode_base64(
+        user_signing_private_key.public_key().public_bytes(
+            Encoding.Raw, PublicFormat.Raw
+        )
+    )
+    b64_user_signing_private_key = encode_base64(USER_CROSS_SIGNING_PRIVATE_KEY_BYTES)
+
+    backup_decryption_key = x25519.X25519PrivateKey.from_private_bytes(
+        base64.b64decode(B64_BACKUP_DECRYPTION_KEY)
+    )
+    b64_backup_public_key = encode_base64(
+        backup_decryption_key.public_key().public_bytes(Encoding.Raw, PublicFormat.Raw)
+    )
+
+    backup_data = {
+        "algorithm": "m.megolm_backup.v1.curve25519-aes-sha2",
+        "version": "1",
+        "auth_data": {
+            "public_key": b64_backup_public_key,
+        },
+    }
+    # sign with our device key
+    sig = sign_json(backup_data["auth_data"], private_key)
+    backup_data["auth_data"]["signatures"] = {
+        TEST_USER_ID: {f"ed25519:{TEST_DEVICE_ID}": sig}
+    }

    print(
        f"""\
@@ -81,11 +125,13 @@ def main() -> None:

 import {{ IDeviceKeys }} from "../../../src/@types/crypto";
 import {{ IDownloadKeyResult }} from "../../../src";
+import {{ KeyBackupInfo }} from "../../../src/crypto-api";

 /* eslint-disable comma-dangle */

 export const TEST_USER_ID = "{TEST_USER_ID}";
 export const TEST_DEVICE_ID = "{TEST_DEVICE_ID}";
+export const TEST_ROOM_ID = "{TEST_ROOM_ID}";

 /** The base64-encoded public ed25519 key for this device */
 export const TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64 = "{b64_public_key}";
@@ -96,10 +142,31 @@ export const SIGNED_TEST_DEVICE_DATA: IDeviceKeys = {json.dumps(device_data, ind
 /** base64-encoded public master cross-signing key */
 export const MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_master_public_key}";

+/** base64-encoded private master cross-signing key */
+export const MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_master_private_key}";
+
+/** base64-encoded public self cross-signing key */
+export const SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_self_signing_public_key}";
+
+/** base64-encoded private self signing cross-signing key */
+export const SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_self_signing_private_key}";
+
+/** base64-encoded public user cross-signing key */
+export const USER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "{b64_user_signing_public_key}";
+
+/** base64-encoded private user signing cross-signing key */
+export const USER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "{b64_user_signing_private_key}";
+
 /** Signed cross-signing keys data, also suitable for returning from a `/keys/query` call */
 export const SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
        json.dumps(build_cross_signing_keys_data(), indent=4)
 };
+
+/** base64-encoded backup decryption (private) key */
+export const BACKUP_DECRYPTION_KEY_BASE64 = "{ B64_BACKUP_DECRYPTION_KEY }";
+
+/** Signed backup data, suitable for return from `GET /_matrix/client/v3/room_keys/keys/{{roomId}}/{{sessionId}}` */
+export const SIGNED_BACKUP_DATA: KeyBackupInfo = { json.dumps(backup_data, indent=4) };
 """,
        end="",
    )
@@ -5,11 +5,13 @@

 import { IDeviceKeys } from "../../../src/@types/crypto";
 import { IDownloadKeyResult } from "../../../src";
+import { KeyBackupInfo } from "../../../src/crypto-api";

 /* eslint-disable comma-dangle */

 export const TEST_USER_ID = "@alice:localhost";
 export const TEST_DEVICE_ID = "test_device";
+export const TEST_ROOM_ID = "!room:id";

 /** The base64-encoded public ed25519 key for this device */
 export const TEST_DEVICE_PUBLIC_ED25519_KEY_BASE64 = "YI/7vbGVLpGdYtuceQR8MSsKB/QjgfMXM1xqnn+0NWU";
@@ -36,6 +38,21 @@ export const SIGNED_TEST_DEVICE_DATA: IDeviceKeys = {
 /** base64-encoded public master cross-signing key */
 export const MASTER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "J+5An10v1vzZpAXTYFokD1/PEVccFnLC61EfRXit0UY";

+/** base64-encoded private master cross-signing key */
+export const MASTER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "ZG95b3VzcGVha3doYWFhYWFhYWFhYWFhYWFhYWFhbGU";
+
+/** base64-encoded public self cross-signing key */
+export const SELF_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "aU2+2CyXQTCuDcmWW0EL2bhJ6PdjFW2LbAsbHqf02AY";
+
+/** base64-encoded private self signing cross-signing key */
+export const SELF_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "c2VsZnNlbGZzZWxmc2VsZnNlbGZzZWxmc2VsZnNlbGY";
+
+/** base64-encoded public user cross-signing key */
+export const USER_CROSS_SIGNING_PUBLIC_KEY_BASE64 = "g5TC/zjQXyZYuDLZv7a41z5fFVrXpYPypG//AFQj8hY";
+
+/** base64-encoded private user signing cross-signing key */
+export const USER_CROSS_SIGNING_PRIVATE_KEY_BASE64 = "dXNlcnVzZXJ1c2VydXNlcnVzZXJ1c2VydXNlcnVzZXI";
+
 /** Signed cross-signing keys data, also suitable for returning from a `/keys/query` call */
 export const SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
    "master_keys": {
@@ -82,3 +99,20 @@ export const SIGNED_CROSS_SIGNING_KEYS_DATA: Partial<IDownloadKeyResult> = {
        }
    }
 };
+
+/** base64-encoded backup decryption (private) key */
+export const BACKUP_DECRYPTION_KEY_BASE64 = "dwdtCnMYpX08FsFyUbJmRd9ML4frwJkqsXf7pR25LCo=";
+
+/** Signed backup data, suitable for return from `GET /_matrix/client/v3/room_keys/keys/{roomId}/{sessionId}` */
+export const SIGNED_BACKUP_DATA: KeyBackupInfo = {
+    "algorithm": "m.megolm_backup.v1.curve25519-aes-sha2",
+    "version": "1",
+    "auth_data": {
+        "public_key": "hSDwCYkwp1R0i33ctD73Wg2/Og0mOBr066SpjqqbTmo",
+        "signatures": {
+            "@alice:localhost": {
+                "ed25519:test_device": "KDSNeumirTsd8piI0oVfv/wzg4J4HlEc7rs5XhODFcJ/YAcUdg65ajsZG+rLI0TQOSSGjorJqcrSiSB1HRSCAA"
+            }
+        }
+    }
+};
@@ -6,9 +6,19 @@ import "../olm-loader";

 import { logger } from "../../src/logger";
 import { IContent, IEvent, IEventRelation, IUnsigned, MatrixEvent, MatrixEventEvent } from "../../src/models/event";
-import { ClientEvent, EventType, IPusher, MatrixClient, MsgType, RelationType } from "../../src";
+import {
+    ClientEvent,
+    EventType,
+    IJoinedRoom,
+    IPusher,
+    ISyncResponse,
+    MatrixClient,
+    MsgType,
+    RelationType,
+} from "../../src";
 import { SyncState } from "../../src/sync";
 import { eventMapperFor } from "../../src/event-mapper";
+import { TEST_ROOM_ID } from "./test-data";

 /**
 * Return a promise that is resolved when the client next emits a
@@ -39,6 +49,61 @@ export function syncPromise(client: MatrixClient, count = 1): Promise<void> {
    });
 }

+/**
+ * Return a sync response which contains a single room (by default TEST_ROOM_ID), with the members given
+ * @param roomMembers
+ * @param roomId
+ *
+ * @returns the sync response
+ */
+export function getSyncResponse(roomMembers: string[], roomId = TEST_ROOM_ID): ISyncResponse {
+    const roomResponse: IJoinedRoom = {
+        summary: {
+            "m.heroes": [],
+            "m.joined_member_count": roomMembers.length,
+            "m.invited_member_count": roomMembers.length,
+        },
+        state: {
+            events: [
+                mkEventCustom({
+                    sender: roomMembers[0],
+                    type: "m.room.encryption",
+                    state_key: "",
+                    content: {
+                        algorithm: "m.megolm.v1.aes-sha2",
+                    },
+                }),
+            ],
+        },
+        timeline: {
+            events: [],
+            prev_batch: "",
+        },
+        ephemeral: { events: [] },
+        account_data: { events: [] },
+        unread_notifications: {},
+    };
+
+    for (let i = 0; i < roomMembers.length; i++) {
+        roomResponse.state.events.push(
+            mkMembershipCustom({
+                membership: "join",
+                sender: roomMembers[i],
+            }),
+        );
+    }
+
+    return {
+        next_batch: "1",
+        rooms: {
+            join: { [roomId]: roomResponse },
+            invite: {},
+            leave: {},
+        },
+        account_data: { events: [] },
+    };
+}
+
 /**
 * Create a spy for an object and automatically spy its methods.
 * @param constr - The class constructor (used with 'new')
@@ -18,7 +18,7 @@ import { RelationType } from "../../src/@types/event";
 import { MatrixClient } from "../../src/client";
 import { MatrixEvent, MatrixEventEvent } from "../../src/models/event";
 import { Room } from "../../src/models/room";
-import { Thread } from "../../src/models/thread";
+import { Thread, THREAD_RELATION_TYPE } from "../../src/models/thread";
 import { mkMessage } from "./test-utils";

 export const makeThreadEvent = ({
@@ -34,7 +34,7 @@ export const makeThreadEvent = ({
        ...props,
        relatesTo: {
            event_id: rootEventId,
-            rel_type: "m.thread",
+            rel_type: THREAD_RELATION_TYPE.name,
            ["m.in_reply_to"]: {
                event_id: replyToEventId,
            },
@@ -157,7 +157,7 @@ export const mkThread = ({
        room?.reEmitter.reEmit(evt, [MatrixEventEvent.BeforeRedaction]);
    }

-    const thread = room.createThread(rootEvent.getId() ?? "", rootEvent, events, true);
+    const thread = room.createThread(rootEvent.getId() ?? "", rootEvent, [rootEvent, ...events], true);

    return { thread, rootEvent, events };
 };
@@ -15,10 +15,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import fetchMock from "fetch-mock-jest";
 import MockHttpBackend from "matrix-mock-request";

+import { M_AUTHENTICATION } from "../../src";
 import { AutoDiscovery } from "../../src/autodiscovery";
 import { OidcError } from "../../src/oidc/error";
+import { makeDelegatedAuthConfig } from "../test-utils/oidc";
+
+// keep to reset the fetch function after using MockHttpBackend
+// @ts-ignore private property
+const realAutoDiscoveryFetch: typeof global.fetch = AutoDiscovery.fetchFn;

 describe("AutoDiscovery", function () {
    const getHttpBackend = (): MockHttpBackend => {
@@ -27,6 +34,10 @@ describe("AutoDiscovery", function () {
        return httpBackend;
    };

+    afterAll(() => {
+        AutoDiscovery.setFetchFn(realAutoDiscoveryFetch);
+    });
+
    it("should throw an error when no domain is specified", function () {
        getHttpBackend();
        return Promise.all([
@@ -855,4 +866,75 @@ describe("AutoDiscovery", function () {
            }),
        ]);
    });
+
+    describe("m.authentication", () => {
+        const homeserverName = "example.org";
+        const homeserverUrl = "https://chat.example.org/";
+        const issuer = "https://auth.org/";
+
+        beforeAll(() => {
+            // make these tests independent from fetch mocking above
+            AutoDiscovery.setFetchFn(realAutoDiscoveryFetch);
+        });
+
+        beforeEach(() => {
+            fetchMock.resetBehavior();
+            fetchMock.get(`${homeserverUrl}_matrix/client/versions`, { versions: ["r0.0.1"] });
+
+            fetchMock.get("https://example.org/.well-known/matrix/client", {
+                "m.homeserver": {
+                    // Note: we also expect this test to trim the trailing slash
+                    base_url: "https://chat.example.org/",
+                },
+                "m.authentication": {
+                    issuer,
+                },
+            });
+        });
+
+        it("should return valid authentication configuration", async () => {
+            const config = makeDelegatedAuthConfig(issuer);
+
+            fetchMock.get(`${config.metadata.issuer}.well-known/openid-configuration`, config.metadata);
+            fetchMock.get(`${config.metadata.issuer}jwks`, {
+                status: 200,
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                keys: [],
+            });
+
+            const result = await AutoDiscovery.findClientConfig(homeserverName);
+
+            expect(result[M_AUTHENTICATION.stable!]).toEqual({
+                state: AutoDiscovery.SUCCESS,
+                ...config,
+                signingKeys: [],
+                account: undefined,
+                error: null,
+            });
+        });
+
+        it("should set state to error for invalid authentication configuration", async () => {
+            const config = makeDelegatedAuthConfig(issuer);
+            // authorization_code is required
+            config.metadata.grant_types_supported = ["openid"];
+
+            fetchMock.get(`${config.metadata.issuer}.well-known/openid-configuration`, config.metadata);
+            fetchMock.get(`${config.metadata.issuer}jwks`, {
+                status: 200,
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                keys: [],
+            });
+
+            const result = await AutoDiscovery.findClientConfig(homeserverName);
+
+            expect(result[M_AUTHENTICATION.stable!]).toEqual({
+                state: AutoDiscovery.FAIL_ERROR,
+                error: OidcError.OpSupport,
+            });
+        });
+    });
 });
@@ -129,7 +129,7 @@ describe("DeviceList", function () {
        });
    });

-    it("should have an outdated devicelist on an invalidation while an " + "update is in progress", function () {
+    it("should have an outdated devicelist on an invalidation while an update is in progress", async function () {
        const dl = createTestDeviceList();

        dl.startTrackingDeviceList("@test1:sw1v.org");
@@ -148,11 +148,8 @@ describe("DeviceList", function () {
        dl.invalidateUserDeviceList("@test1:sw1v.org");
        dl.refreshOutdatedDeviceLists();

-        // TODO: Fix this test so we actually await the call and assertions and remove
-        // the eslint disable, https://github.com/matrix-org/matrix-js-sdk/issues/2977
-        //
-        // eslint-disable-next-line jest/valid-expect-in-promise
-        dl.saveIfDirty()
+        await dl
+            .saveIfDirty()
            .then(() => {
                // the first request completes
                queryDefer1.resolve({
@@ -163,12 +160,13 @@ describe("DeviceList", function () {
                });
                return prom1;
            })
-            .then(() => {
+            .then(async () => {
                // uh-oh; user restarts before second request completes. The new instance
                // should know we never got a complete device list.
                logger.log("Creating new devicelist to simulate app reload");
                downloadSpy.mockReset();
                const dl2 = createTestDeviceList();
+                await dl2.load();
                const queryDefer3 = utils.defer<IDownloadKeyResult>();
                downloadSpy.mockReturnValue(queryDefer3.promise);

@@ -14,11 +14,14 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import { mocked } from "jest-mock";
+
 import { FetchHttpApi } from "../../../src/http-api/fetch";
 import { TypedEventEmitter } from "../../../src/models/typed-event-emitter";
 import { ClientPrefix, HttpApiEvent, HttpApiEventHandlerMap, IdentityPrefix, IHttpOpts, Method } from "../../../src";
 import { emitPromise } from "../../test-utils/test-utils";
-import { QueryDict } from "../../../src/utils";
+import { defer, QueryDict } from "../../../src/utils";
+import { logger } from "../../../src/logger";

 describe("FetchHttpApi", () => {
    const baseUrl = "http://baseUrl";
@@ -274,11 +277,13 @@ describe("FetchHttpApi", () => {
        ];
        const runTests = (fetchBaseUrl: string) => {
            it.each<TestCase>(testCases)(
-                "creates url with params %s",
-                ({ path, queryParams, prefix, baseUrl }, result) => {
+                "creates url with params %s => %s",
+                ({ path, queryParams, prefix, baseUrl }, expected) => {
                    const api = makeApi(fetchBaseUrl);

-                    expect(api.getUrl(path, queryParams, prefix, baseUrl)).toEqual(new URL(result));
+                    const result = api.getUrl(path, queryParams, prefix, baseUrl);
+                    // we only check the stringified URL, to avoid having the test depend on the internals of URL.
+                    expect(result.toString()).toEqual(expected);
                },
            );
        };
@@ -290,4 +295,30 @@ describe("FetchHttpApi", () => {
            runTests(baseUrlWithTrailingSlash);
        });
    });
+
+    it("should not log query parameters", async () => {
+        jest.useFakeTimers();
+        const deferred = defer<Response>();
+        const fetchFn = jest.fn().mockReturnValue(deferred.promise);
+        jest.spyOn(logger, "debug").mockImplementation(() => {});
+        const api = new FetchHttpApi(new TypedEventEmitter<any, any>(), { baseUrl, prefix, fetchFn });
+        const prom = api.requestOtherUrl(Method.Get, "https://server:8448/some/path?query=param#fragment");
+        jest.advanceTimersByTime(1234);
+        deferred.resolve({ ok: true, status: 200, text: () => Promise.resolve("RESPONSE") } as Response);
+        await prom;
+        expect(logger.debug).not.toHaveBeenCalledWith("fragment");
+        expect(logger.debug).not.toHaveBeenCalledWith("query");
+        expect(logger.debug).not.toHaveBeenCalledWith("param");
+        expect(logger.debug).toHaveBeenCalledTimes(2);
+        expect(mocked(logger.debug).mock.calls[0]).toMatchInlineSnapshot(`
+            [
+              "FetchHttpApi: --> GET https://server:8448/some/path?query=xxx",
+            ]
+        `);
+        expect(mocked(logger.debug).mock.calls[1]).toMatchInlineSnapshot(`
+            [
+              "FetchHttpApi: <-- GET https://server:8448/some/path?query=xxx [1234ms 200]",
+            ]
+        `);
+    });
 });
@@ -94,7 +94,6 @@ describe("InteractiveAuth", () => {
            authData: {
                session: "sessionId",
                flows: [{ stages: [AuthType.Password] }],
-                errcode: "MockError0",
                params: {
                    [AuthType.Password]: { param: "aa" },
                },
@@ -376,7 +375,7 @@ describe("InteractiveAuth", () => {
        await expect(ia.attemptAuth.bind(ia)).rejects.toThrow(new Error("No appropriate authentication flow found"));
    });

-    it("should handle unexpected error types without data propery set", async () => {
+    it("should handle unexpected error types without data property set", async () => {
        const doRequest = jest.fn();
        const stateUpdated = jest.fn();
        const requestEmailToken = jest.fn();
@@ -560,4 +559,40 @@ describe("InteractiveAuth", () => {
        ia.chooseStage();
        expect(ia.getChosenFlow()?.stages).toEqual([AuthType.Password]);
    });
+
+    it("should fire stateUpdated callback if with error when encountered", async () => {
+        const doRequest = jest.fn();
+        const stateUpdated = jest.fn();
+
+        const ia = new InteractiveAuth({
+            matrixClient: getFakeClient(),
+            doRequest: doRequest,
+            stateUpdated: stateUpdated,
+            requestEmailToken: jest.fn(),
+            authData: {
+                session: "sessionId",
+                flows: [{ stages: [AuthType.Password] }],
+                params: {
+                    [AuthType.Password]: { param: "aa" },
+                },
+            },
+        });
+
+        // first we expect a call here
+        stateUpdated.mockImplementation((stage) => {
+            expect(stage).toEqual(AuthType.Password);
+            ia.submitAuthDict({
+                type: AuthType.Password,
+            });
+        });
+
+        // .. which should trigger a call here
+        doRequest.mockRejectedValue(new MatrixError({ errcode: "M_UNKNOWN", error: "This is an error" }));
+
+        await Promise.allSettled([ia.attemptAuth()]);
+        expect(stateUpdated).toHaveBeenCalledWith("m.login.password", {
+            errcode: "M_UNKNOWN",
+            error: "This is an error",
+        });
+    });
 });
@@ -121,7 +121,7 @@ describe("refreshToken", () => {
            body: { errcode: "M_UNRECOGNIZED" },
        });

-        expect(client.refreshToken("initial_refresh_token")).rejects.toMatchObject({ errcode: "M_UNRECOGNIZED" });
+        await expect(client.refreshToken("initial_refresh_token")).rejects.toMatchObject({ errcode: "M_UNRECOGNIZED" });
    });

    it("re-raises non-M_UNRECOGNIZED exceptions from /v3", async () => {
@@ -132,7 +132,7 @@ describe("refreshToken", () => {
            throw new Error("/v1/refresh unexpectedly called");
        });

-        expect(client.refreshToken("initial_refresh_token")).rejects.toMatchObject({ httpStatus: 429 });
+        await expect(client.refreshToken("initial_refresh_token")).rejects.toMatchObject({ httpStatus: 429 });
    });

    it("re-raises non-M_UNRECOGNIZED exceptions from /v1", async () => {
@@ -144,6 +144,6 @@ describe("refreshToken", () => {
        });
        fetchMock.postOnce(client.http.getUrl("/refresh", undefined, ClientPrefix.V1).toString(), 429);

-        expect(client.refreshToken("initial_refresh_token")).rejects.toMatchObject({ httpStatus: 429 });
+        await expect(client.refreshToken("initial_refresh_token")).rejects.toMatchObject({ httpStatus: 429 });
    });
 });
@@ -308,4 +308,25 @@ describe("MatrixEvent", () => {
            });
        });
    });
+
+    it("should ignore thread relation on state events", async () => {
+        const stateEvent = new MatrixEvent({
+            event_id: "$event_id",
+            type: "some_state_event",
+            content: {
+                "foo": "bar",
+                "m.relates_to": {
+                    "event_id": "$thread_id",
+                    "m.in_reply_to": {
+                        event_id: "$thread_id",
+                    },
+                    "rel_type": "m.thread",
+                },
+            },
+            state_key: "",
+        });
+
+        expect(stateEvent.isState()).toBeTruthy();
+        expect(stateEvent.threadRootId).toBeUndefined();
+    });
 });
@@ -18,7 +18,7 @@ import { mocked } from "jest-mock";

 import { MatrixClient, PendingEventOrdering } from "../../../src/client";
 import { Room, RoomEvent } from "../../../src/models/room";
-import { Thread, THREAD_RELATION_TYPE, ThreadEvent, FeatureSupport } from "../../../src/models/thread";
+import { FeatureSupport, Thread, THREAD_RELATION_TYPE, ThreadEvent } from "../../../src/models/thread";
 import { makeThreadEvent, mkThread } from "../../test-utils/thread";
 import { TestClient } from "../../TestClient";
 import { emitPromise, mkEdit, mkMessage, mkReaction, mock } from "../../test-utils/test-utils";
@@ -43,6 +43,7 @@ describe("Thread", () => {
        const myUserId = "@bob:example.org";
        const testClient = new TestClient(myUserId, "DEVICE", "ACCESS_TOKEN", undefined, { timelineSupport: false });
        const client = testClient.client;
+        client.supportsThreads = jest.fn().mockReturnValue(true);
        const room = new Room("123", client, myUserId, {
            pendingEventOrdering: PendingEventOrdering.Detached,
        });
@@ -300,6 +301,7 @@ describe("Thread", () => {
                timelineSupport: false,
            });
            const client = testClient.client;
+            client.supportsThreads = jest.fn().mockReturnValue(true);
            const room = new Room("123", client, myUserId, {
                pendingEventOrdering: PendingEventOrdering.Detached,
            });
@@ -354,6 +356,7 @@ describe("Thread", () => {
                timelineSupport: false,
            });
            const client = testClient.client;
+            client.supportsThreads = jest.fn().mockReturnValue(true);
            const room = new Room("123", client, myUserId, {
                pendingEventOrdering: PendingEventOrdering.Detached,
            });
@@ -405,6 +408,7 @@ describe("Thread", () => {
                timelineSupport: false,
            });
            const client = testClient.client;
+            client.supportsThreads = jest.fn().mockReturnValue(true);
            const room = new Room("123", client, myUserId, {
                pendingEventOrdering: PendingEventOrdering.Detached,
            });
@@ -1,3 +1,7 @@
+/**
+ * @jest-environment jsdom
+ */
+
 /*
 Copyright 2023 The Matrix.org Foundation C.I.C.

@@ -15,6 +19,8 @@ limitations under the License.
 */

 import fetchMock from "fetch-mock-jest";
+import { mocked } from "jest-mock";
+import jwtDecode from "jwt-decode";

 import { Method } from "../../../src";
 import * as crypto from "../../../src/crypto/crypto";
@@ -23,27 +29,31 @@ import {
    completeAuthorizationCodeGrant,
    generateAuthorizationParams,
    generateAuthorizationUrl,
+    generateOidcAuthorizationUrl,
 } from "../../../src/oidc/authorize";
 import { OidcError } from "../../../src/oidc/error";
+import { makeDelegatedAuthConfig, mockOpenIdConfiguration } from "../../test-utils/oidc";
+
+jest.mock("jwt-decode");

 // save for resetting mocks
 const realSubtleCrypto = crypto.subtleCrypto;

 describe("oidc authorization", () => {
-    const issuer = "https://auth.com/";
-    const authorizationEndpoint = "https://auth.com/authorization";
-    const tokenEndpoint = "https://auth.com/token";
-    const delegatedAuthConfig = {
-        issuer,
-        registrationEndpoint: issuer + "registration",
-        authorizationEndpoint: issuer + "auth",
-        tokenEndpoint,
-    };
+    const delegatedAuthConfig = makeDelegatedAuthConfig();
+    const authorizationEndpoint = delegatedAuthConfig.metadata.authorization_endpoint;
+    const tokenEndpoint = delegatedAuthConfig.metadata.token_endpoint;
    const clientId = "xyz789";
    const baseUrl = "https://test.com";

+    // 14.03.2022 16:15
+    const now = 1647270879403;
+
    beforeAll(() => {
        jest.spyOn(logger, "warn");
+        jest.setSystemTime(now);
+
+        fetchMock.get(delegatedAuthConfig.issuer + ".well-known/openid-configuration", mockOpenIdConfiguration());
    });

    afterEach(() => {
@@ -93,117 +103,293 @@ describe("oidc authorization", () => {
                "A secure context is required to generate code challenge. Using plain text code challenge",
            );
        });
+    });
+
+    describe("generateOidcAuthorizationUrl()", () => {
+        it("should generate url with correct parameters", async () => {
+            const nonce = "abc123";
+
+            const metadata = delegatedAuthConfig.metadata;

-        it("uses a s256 code challenge when crypto is available", async () => {
-            jest.spyOn(crypto.subtleCrypto, "digest");
-            const authorizationParams = generateAuthorizationParams({ redirectUri: baseUrl });
            const authUrl = new URL(
-                await generateAuthorizationUrl(authorizationEndpoint, clientId, authorizationParams),
+                await generateOidcAuthorizationUrl({
+                    metadata,
+                    homeserverUrl: baseUrl,
+                    clientId,
+                    redirectUri: baseUrl,
+                    nonce,
+                }),
            );

-            const codeChallenge = authUrl.searchParams.get("code_challenge");
-            expect(crypto.subtleCrypto.digest).toHaveBeenCalledWith("SHA-256", expect.any(Object));
+            expect(authUrl.searchParams.get("response_mode")).toEqual("query");
+            expect(authUrl.searchParams.get("response_type")).toEqual("code");
+            expect(authUrl.searchParams.get("client_id")).toEqual(clientId);
+            expect(authUrl.searchParams.get("code_challenge_method")).toEqual("S256");
+            // scope minus the 10char random device id at the end
+            expect(authUrl.searchParams.get("scope")!.slice(0, -10)).toEqual(
+                "openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:",
+            );
+            expect(authUrl.searchParams.get("state")).toBeTruthy();
+            expect(authUrl.searchParams.get("nonce")).toEqual(nonce);

-            // didn't use plain text code challenge
-            expect(authorizationParams.codeVerifier).not.toEqual(codeChallenge);
-            expect(codeChallenge).toBeTruthy();
+            expect(authUrl.searchParams.get("code_challenge")).toBeTruthy();
        });
    });

    describe("completeAuthorizationCodeGrant", () => {
-        const codeVerifier = "abc123";
+        const homeserverUrl = "https://server.org/";
+        const identityServerUrl = "https://id.org/";
+        const nonce = "test-nonce";
        const redirectUri = baseUrl;
        const code = "auth_code_xyz";
        const validBearerTokenResponse = {
            token_type: "Bearer",
            access_token: "test_access_token",
            refresh_token: "test_refresh_token",
-            expires_in: 12345,
+            id_token: "valid.id.token",
+            expires_in: 300,
+        };
+
+        const metadata = mockOpenIdConfiguration();
+
+        const validDecodedIdToken = {
+            // nonce matches
+            nonce,
+            // not expired
+            exp: Date.now() / 1000 + 100000,
+            // audience is this client
+            aud: clientId,
+            // issuer matches
+            iss: metadata.issuer,
+            sub: "123",
+        };
+
+        const mockSessionStorage = (state: Record<string, unknown>): void => {
+            jest.spyOn(sessionStorage.__proto__, "getItem").mockImplementation((key: unknown) => {
+                return state[key as string] ?? null;
+            });
+            jest.spyOn(sessionStorage.__proto__, "setItem").mockImplementation(
+                // @ts-ignore mock type
+                (key: string, value: unknown) => (state[key] = value),
+            );
+            jest.spyOn(sessionStorage.__proto__, "removeItem").mockImplementation((key: unknown) => {
+                const { [key as string]: value, ...newState } = state;
+                state = newState;
+                return value;
+            });
+        };
+
+        const getValueFromStorage = <T = string>(state: string, key: string): T => {
+            const storedState = window.sessionStorage.getItem(`mx_oidc_${state}`)!;
+            return JSON.parse(storedState)[key] as unknown as T;
+        };
+
+        /**
+         * These tests kind of integration test oidc auth, by using `generateOidcAuthorizationUrl` and mocked storage
+         * to mock the use case of initiating oidc auth, putting state in storage, redirecting to OP,
+         * then returning and using state to verfiy.
+         * Returns random state string used to access storage
+         * @param params
+         */
+        const setupState = async (params = {}): Promise<string> => {
+            const url = await generateOidcAuthorizationUrl({
+                metadata,
+                redirectUri,
+                clientId,
+                homeserverUrl,
+                identityServerUrl,
+                nonce,
+                ...params,
+            });
+
+            const state = new URL(url).searchParams.get("state")!;
+
+            // add the scope with correct deviceId to the mocked bearer token response
+            const scope = getValueFromStorage(state, "scope");
+            fetchMock.post(metadata.token_endpoint, {
+                status: 200,
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                ...validBearerTokenResponse,
+                scope,
+            });
+
+            return state;
        };

        beforeEach(() => {
            fetchMock.mockClear();
            fetchMock.resetBehavior();

-            fetchMock.post(tokenEndpoint, {
+            fetchMock.get(`${metadata.issuer}.well-known/openid-configuration`, metadata);
+            fetchMock.get(`${metadata.issuer}jwks`, {
                status: 200,
-                body: JSON.stringify(validBearerTokenResponse),
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                keys: [],
            });
+
+            mockSessionStorage({});
+
+            mocked(jwtDecode).mockReturnValue(validDecodedIdToken);
        });

        it("should make correct request to the token endpoint", async () => {
-            await completeAuthorizationCodeGrant(code, { clientId, codeVerifier, redirectUri, delegatedAuthConfig });
+            const state = await setupState();
+            const codeVerifier = getValueFromStorage(state, "code_verifier");
+            await completeAuthorizationCodeGrant(code, state);

-            expect(fetchMock).toHaveBeenCalledWith(tokenEndpoint, {
-                method: Method.Post,
-                headers: { "Content-Type": "application/x-www-form-urlencoded" },
-                body: `grant_type=authorization_code&client_id=${clientId}&code_verifier=${codeVerifier}&redirect_uri=https%3A%2F%2Ftest.com&code=${code}`,
-            });
+            expect(fetchMock).toHaveBeenCalledWith(
+                metadata.token_endpoint,
+                expect.objectContaining({
+                    method: Method.Post,
+                    credentials: "same-origin",
+                    headers: {
+                        "Accept": "application/json",
+                        "Content-Type": "application/x-www-form-urlencoded",
+                    },
+                }),
+            );
+
+            // check body is correctly formed
+            const queryParams = fetchMock.mock.calls.find(([endpoint]) => endpoint === metadata.token_endpoint)![1]!
+                .body as URLSearchParams;
+            expect(queryParams.get("grant_type")).toEqual("authorization_code");
+            expect(queryParams.get("client_id")).toEqual(clientId);
+            expect(queryParams.get("code_verifier")).toEqual(codeVerifier);
+            expect(queryParams.get("redirect_uri")).toEqual(redirectUri);
+            expect(queryParams.get("code")).toEqual(code);
        });

        it("should return with valid bearer token", async () => {
-            const result = await completeAuthorizationCodeGrant(code, {
-                clientId,
-                codeVerifier,
-                redirectUri,
-                delegatedAuthConfig,
-            });
+            const state = await setupState();
+            const scope = getValueFromStorage(state, "scope");
+            const result = await completeAuthorizationCodeGrant(code, state);

-            expect(result).toEqual(validBearerTokenResponse);
+            expect(result).toEqual({
+                homeserverUrl,
+                identityServerUrl,
+                oidcClientSettings: {
+                    clientId,
+                    issuer: metadata.issuer,
+                },
+                tokenResponse: {
+                    access_token: validBearerTokenResponse.access_token,
+                    id_token: validBearerTokenResponse.id_token,
+                    refresh_token: validBearerTokenResponse.refresh_token,
+                    token_type: validBearerTokenResponse.token_type,
+                    // this value is slightly unstable because it uses the clock
+                    expires_at: result.tokenResponse.expires_at,
+                    scope,
+                },
+            });
        });

        it("should return with valid bearer token where token_type is lowercase", async () => {
+            const state = await setupState();
+            const scope = getValueFromStorage(state, "scope");
            const tokenResponse = {
                ...validBearerTokenResponse,
+                scope,
                token_type: "bearer",
            };
            fetchMock.post(
                tokenEndpoint,
                {
-                    status: 200,
-                    body: JSON.stringify(tokenResponse),
+                    headers: {
+                        "Content-Type": "application/json",
+                    },
+                    ...tokenResponse,
                },
                { overwriteRoutes: true },
            );

-            const result = await completeAuthorizationCodeGrant(code, {
-                clientId,
-                codeVerifier,
-                redirectUri,
-                delegatedAuthConfig,
+            const result = await completeAuthorizationCodeGrant(code, state);
+
+            expect(result).toEqual({
+                homeserverUrl,
+                identityServerUrl,
+                oidcClientSettings: {
+                    clientId,
+                    issuer: metadata.issuer,
+                },
+                // results in token that uses 'Bearer' token type
+                tokenResponse: {
+                    access_token: validBearerTokenResponse.access_token,
+                    id_token: validBearerTokenResponse.id_token,
+                    refresh_token: validBearerTokenResponse.refresh_token,
+                    token_type: "Bearer",
+                    // this value is slightly unstable because it uses the clock
+                    expires_at: result.tokenResponse.expires_at,
+                    scope,
+                },
            });

-            // results in token that uses 'Bearer' token type
-            expect(result).toEqual(validBearerTokenResponse);
-            expect(result.token_type).toEqual("Bearer");
+            expect(result.tokenResponse.token_type).toEqual("Bearer");
        });

-        it("should throw with code exchange failed error when request fails", async () => {
+        it("should throw when state is not found in storage", async () => {
+            // don't setup sessionStorage with expected state
+            const state = "abc123";
            fetchMock.post(
-                tokenEndpoint,
+                metadata.token_endpoint,
                {
                    status: 500,
                },
                { overwriteRoutes: true },
            );
-            await expect(() =>
-                completeAuthorizationCodeGrant(code, { clientId, codeVerifier, redirectUri, delegatedAuthConfig }),
-            ).rejects.toThrow(new Error(OidcError.CodeExchangeFailed));
+            await expect(() => completeAuthorizationCodeGrant(code, state)).rejects.toThrow(
+                new Error(OidcError.MissingOrInvalidStoredState),
+            );
+        });
+
+        it("should throw with code exchange failed error when request fails", async () => {
+            const state = await setupState();
+            fetchMock.post(
+                metadata.token_endpoint,
+                {
+                    status: 500,
+                },
+                { overwriteRoutes: true },
+            );
+            await expect(() => completeAuthorizationCodeGrant(code, state)).rejects.toThrow(
+                new Error(OidcError.CodeExchangeFailed),
+            );
        });

        it("should throw invalid token error when token is invalid", async () => {
+            const state = await setupState();
            const invalidBearerTokenResponse = {
                ...validBearerTokenResponse,
                access_token: null,
            };
            fetchMock.post(
-                tokenEndpoint,
-                { status: 200, body: JSON.stringify(invalidBearerTokenResponse) },
+                metadata.token_endpoint,
+                {
+                    headers: {
+                        "Content-Type": "application/json",
+                    },
+                    ...invalidBearerTokenResponse,
+                },
                { overwriteRoutes: true },
            );
-            await expect(() =>
-                completeAuthorizationCodeGrant(code, { clientId, codeVerifier, redirectUri, delegatedAuthConfig }),
-            ).rejects.toThrow(new Error(OidcError.InvalidBearerTokenResponse));
+            await expect(() => completeAuthorizationCodeGrant(code, state)).rejects.toThrow(
+                new Error(OidcError.InvalidBearerTokenResponse),
+            );
+        });
+
+        it("should throw invalid id token error when id_token is invalid", async () => {
+            const state = await setupState();
+            mocked(jwtDecode).mockReturnValue({
+                ...validDecodedIdToken,
+                // invalid audience
+                aud: "something-else",
+            });
+            await expect(() => completeAuthorizationCodeGrant(code, state)).rejects.toThrow(
+                new Error(OidcError.InvalidIdToken),
+            );
        });
    });
 });
@@ -66,7 +66,7 @@ describe("registerOidcClient()", () => {
        fetchMockJest.post(registrationEndpoint, {
            status: 500,
        });
-        expect(() => registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).rejects.toThrow(
+        await expect(() => registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).rejects.toThrow(
            OidcError.DynamicRegistrationFailed,
        );
    });
@@ -77,7 +77,7 @@ describe("registerOidcClient()", () => {
            // no clientId in response
            body: "{}",
        });
-        expect(() => registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).rejects.toThrow(
+        await expect(() => registerOidcClient(delegatedAuthConfig, clientName, baseUrl)).rejects.toThrow(
            OidcError.DynamicRegistrationInvalid,
        );
    });
@@ -14,11 +14,20 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import { mocked } from "jest-mock";
+import jwtDecode from "jwt-decode";
+
 import { M_AUTHENTICATION } from "../../../src";
 import { logger } from "../../../src/logger";
-import { validateOIDCIssuerWellKnown, validateWellKnownAuthentication } from "../../../src/oidc/validate";
+import {
+    validateIdToken,
+    validateOIDCIssuerWellKnown,
+    validateWellKnownAuthentication,
+} from "../../../src/oidc/validate";
 import { OidcError } from "../../../src/oidc/error";

+jest.mock("jwt-decode");
+
 describe("validateWellKnownAuthentication()", () => {
    const baseWk = {
        "m.homeserver": {
@@ -26,7 +35,7 @@ describe("validateWellKnownAuthentication()", () => {
        },
    };
    it("should throw not supported error when wellKnown has no m.authentication section", () => {
-        expect(() => validateWellKnownAuthentication(baseWk)).toThrow(OidcError.NotSupported);
+        expect(() => validateWellKnownAuthentication(undefined)).toThrow(OidcError.NotSupported);
    });

    it("should throw misconfigured error when authentication issuer is not a string", () => {
@@ -36,7 +45,9 @@ describe("validateWellKnownAuthentication()", () => {
                issuer: { url: "test.com" },
            },
        };
-        expect(() => validateWellKnownAuthentication(wk)).toThrow(OidcError.Misconfigured);
+        expect(() => validateWellKnownAuthentication(wk[M_AUTHENTICATION.stable!] as any)).toThrow(
+            OidcError.Misconfigured,
+        );
    });

    it("should throw misconfigured error when authentication account is not a string", () => {
@@ -47,7 +58,9 @@ describe("validateWellKnownAuthentication()", () => {
                account: { url: "test" },
            },
        };
-        expect(() => validateWellKnownAuthentication(wk)).toThrow(OidcError.Misconfigured);
+        expect(() => validateWellKnownAuthentication(wk[M_AUTHENTICATION.stable!] as any)).toThrow(
+            OidcError.Misconfigured,
+        );
    });

    it("should throw misconfigured error when authentication account is false", () => {
@@ -58,7 +71,9 @@ describe("validateWellKnownAuthentication()", () => {
                account: false,
            },
        };
-        expect(() => validateWellKnownAuthentication(wk)).toThrow(OidcError.Misconfigured);
+        expect(() => validateWellKnownAuthentication(wk[M_AUTHENTICATION.stable!] as any)).toThrow(
+            OidcError.Misconfigured,
+        );
    });

    it("should return valid config when wk uses stable m.authentication", () => {
@@ -69,7 +84,7 @@ describe("validateWellKnownAuthentication()", () => {
                account: "account.com",
            },
        };
-        expect(validateWellKnownAuthentication(wk)).toEqual({
+        expect(validateWellKnownAuthentication(wk[M_AUTHENTICATION.stable!])).toEqual({
            issuer: "test.com",
            account: "account.com",
        });
@@ -82,7 +97,7 @@ describe("validateWellKnownAuthentication()", () => {
                issuer: "test.com",
            },
        };
-        expect(validateWellKnownAuthentication(wk)).toEqual({
+        expect(validateWellKnownAuthentication(wk[M_AUTHENTICATION.stable!])).toEqual({
            issuer: "test.com",
        });
    });
@@ -95,24 +110,10 @@ describe("validateWellKnownAuthentication()", () => {
                somethingElse: "test",
            },
        };
-        expect(validateWellKnownAuthentication(wk)).toEqual({
+        expect(validateWellKnownAuthentication(wk[M_AUTHENTICATION.stable!])).toEqual({
            issuer: "test.com",
        });
    });
-
-    it("should return valid config when wk uses unstable prefix for m.authentication", () => {
-        const wk = {
-            ...baseWk,
-            [M_AUTHENTICATION.unstable!]: {
-                issuer: "test.com",
-                account: "account.com",
-            },
-        };
-        expect(validateWellKnownAuthentication(wk)).toEqual({
-            issuer: "test.com",
-            account: "account.com",
-        });
-    });
 });

 describe("validateOIDCIssuerWellKnown", () => {
@@ -120,6 +121,7 @@ describe("validateOIDCIssuerWellKnown", () => {
        authorization_endpoint: "https://test.org/authorize",
        token_endpoint: "https://authorize.org/token",
        registration_endpoint: "https://authorize.org/regsiter",
+        revocation_endpoint: "https://authorize.org/regsiter",
        response_types_supported: ["code"],
        grant_types_supported: ["authorization_code"],
        code_challenge_methods_supported: ["S256"],
@@ -146,10 +148,8 @@ describe("validateOIDCIssuerWellKnown", () => {
                response_types_supported: [],
            });
        }).toThrow(OidcError.OpSupport);
-        expect(logger.error).toHaveBeenCalledWith("OIDC issuer configuration: authorization_endpoint is invalid");
-        expect(logger.error).toHaveBeenCalledWith(
-            "OIDC issuer configuration: response_types_supported is invalid. code is required.",
-        );
+        expect(logger.error).toHaveBeenCalledWith("Missing or invalid property: authorization_endpoint");
+        expect(logger.error).toHaveBeenCalledWith("Invalid property: response_types_supported. code is required.");
    });

    it("should return validated issuer config", () => {
@@ -194,3 +194,96 @@ describe("validateOIDCIssuerWellKnown", () => {
        expect(() => validateOIDCIssuerWellKnown(wk)).toThrow(OidcError.OpSupport);
    });
 });
+
+describe("validateIdToken()", () => {
+    const nonce = "test-nonce";
+    const issuer = "https://auth.org/issuer";
+    const clientId = "test-client-id";
+    const idToken = "test-id-token";
+
+    const validDecodedIdToken = {
+        // nonce matches
+        nonce,
+        // not expired
+        exp: Date.now() / 1000 + 5555,
+        // audience is this client
+        aud: clientId,
+        // issuer matches
+        iss: issuer,
+    };
+    beforeEach(() => {
+        mocked(jwtDecode).mockClear().mockReturnValue(validDecodedIdToken);
+
+        jest.spyOn(logger, "error").mockClear();
+    });
+
+    it("should throw when idToken is falsy", () => {
+        expect(() => validateIdToken(undefined, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+    });
+
+    it("should throw when idToken cannot be decoded", () => {
+        mocked(jwtDecode).mockImplementation(() => {
+            throw new Error("oh no!");
+        });
+        expect(() => validateIdToken(undefined, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+    });
+
+    it("should throw when issuer does not match", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            iss: "https://badissuer.com",
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid issuer"));
+    });
+
+    it("should throw when audience does not include clientId", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            aud: "qwerty,uiop,asdf",
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid audience"));
+    });
+
+    it("should throw when audience includes clientId and other audiences", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            aud: `${clientId},uiop,asdf`,
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid audience"));
+    });
+
+    it("should throw when nonce does not match", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            nonce: "something else",
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid nonce"));
+    });
+
+    it("should throw when token does not have an expiry", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            exp: undefined,
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid expiry"));
+    });
+
+    it("should throw when token is expired", () => {
+        mocked(jwtDecode).mockReturnValue({
+            ...validDecodedIdToken,
+            // expired in the past
+            exp: Date.now() / 1000 - 777,
+        });
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
+        expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid expiry"));
+    });
+
+    it("should not throw for a valid id token", () => {
+        expect(() => validateIdToken(idToken, issuer, clientId, nonce)).not.toThrow();
+    });
+});
@@ -657,7 +657,7 @@ describe("NotificationService", function () {
                    content: {
                        "body": "",
                        "msgtype": "m.text",
-                        "org.matrix.msc3952.mentions": {},
+                        "m.mentions": {},
                    },
                });

@@ -16,9 +16,9 @@ limitations under the License.

 import MockHttpBackend from "matrix-mock-request";

-import { MAIN_ROOM_TIMELINE, ReceiptType } from "../../src/@types/read_receipts";
+import { MAIN_ROOM_TIMELINE, ReceiptType, WrappedReceipt } from "../../src/@types/read_receipts";
 import { MatrixClient } from "../../src/client";
-import { EventType } from "../../src/matrix";
+import { EventType, MatrixEvent, Room } from "../../src/matrix";
 import { synthesizeReceipt } from "../../src/models/read-receipt";
 import { encodeUri } from "../../src/utils";
 import * as utils from "../test-utils/test-utils";
@@ -42,42 +42,46 @@ let httpBackend: MockHttpBackend;
 const THREAD_ID = "$thread_event_id";
 const ROOM_ID = "!123:matrix.org";

-const threadEvent = utils.mkEvent({
-    event: true,
-    type: EventType.RoomMessage,
-    user: "@bob:matrix.org",
-    room: ROOM_ID,
-    content: {
-        "body": "Hello from a thread",
-        "m.relates_to": {
-            "event_id": THREAD_ID,
-            "m.in_reply_to": {
-                event_id: THREAD_ID,
-            },
-            "rel_type": "m.thread",
-        },
-    },
-});
-
-const roomEvent = utils.mkEvent({
-    event: true,
-    type: EventType.RoomMessage,
-    user: "@bob:matrix.org",
-    room: ROOM_ID,
-    content: {
-        body: "Hello from a room",
-    },
-});
-
 describe("Read receipt", () => {
+    let threadEvent: MatrixEvent;
+    let roomEvent: MatrixEvent;
+
    beforeEach(() => {
        httpBackend = new MockHttpBackend();
        client = new MatrixClient({
+            userId: "@user:server",
            baseUrl: "https://my.home.server",
            accessToken: "my.access.token",
            fetchFn: httpBackend.fetchFn as typeof global.fetch,
        });
        client.isGuest = () => false;
+        client.supportsThreads = () => true;
+
+        threadEvent = utils.mkEvent({
+            event: true,
+            type: EventType.RoomMessage,
+            user: "@bob:matrix.org",
+            room: ROOM_ID,
+            content: {
+                "body": "Hello from a thread",
+                "m.relates_to": {
+                    "event_id": THREAD_ID,
+                    "m.in_reply_to": {
+                        event_id: THREAD_ID,
+                    },
+                    "rel_type": "m.thread",
+                },
+            },
+        });
+        roomEvent = utils.mkEvent({
+            event: true,
+            type: EventType.RoomMessage,
+            user: "@bob:matrix.org",
+            room: ROOM_ID,
+            content: {
+                body: "Hello from a room",
+            },
+        });
    });

    describe("sendReceipt", () => {
@@ -143,13 +147,69 @@ describe("Read receipt", () => {
            await httpBackend.flushAllExpected();
            await flushPromises();
        });
+
+        it("should send a main timeline read receipt for a reaction to a thread root", async () => {
+            roomEvent.event.event_id = THREAD_ID;
+            const reaction = utils.mkReaction(roomEvent, client, client.getSafeUserId(), ROOM_ID);
+            const thread = new Room(ROOM_ID, client, client.getSafeUserId()).createThread(
+                THREAD_ID,
+                roomEvent,
+                [threadEvent],
+                false,
+            );
+            threadEvent.setThread(thread);
+            reaction.setThread(thread);
+
+            httpBackend
+                .when(
+                    "POST",
+                    encodeUri("/rooms/$roomId/receipt/$receiptType/$eventId", {
+                        $roomId: ROOM_ID,
+                        $receiptType: ReceiptType.Read,
+                        $eventId: reaction.getId()!,
+                    }),
+                )
+                .check((request) => {
+                    expect(request.data.thread_id).toEqual(MAIN_ROOM_TIMELINE);
+                })
+                .respond(200, {});
+
+            client.sendReceipt(reaction, ReceiptType.Read, {});
+
+            await httpBackend.flushAllExpected();
+            await flushPromises();
+        });
+
+        it("should always send unthreaded receipts if threads support is disabled", async () => {
+            client.supportsThreads = () => false;
+
+            httpBackend
+                .when(
+                    "POST",
+                    encodeUri("/rooms/$roomId/receipt/$receiptType/$eventId", {
+                        $roomId: ROOM_ID,
+                        $receiptType: ReceiptType.Read,
+                        $eventId: roomEvent.getId()!,
+                    }),
+                )
+                .check((request) => {
+                    expect(request.data.thread_id).toEqual(undefined);
+                })
+                .respond(200, {});
+
+            client.sendReceipt(roomEvent, ReceiptType.Read, {});
+
+            await httpBackend.flushAllExpected();
+            await flushPromises();
+        });
    });

    describe("synthesizeReceipt", () => {
        it.each([
-            { event: roomEvent, destinationId: MAIN_ROOM_TIMELINE },
-            { event: threadEvent, destinationId: threadEvent.threadRootId! },
-        ])("adds the receipt to $destinationId", ({ event, destinationId }) => {
+            { getEvent: () => roomEvent, destinationId: MAIN_ROOM_TIMELINE },
+            { getEvent: () => threadEvent, destinationId: THREAD_ID },
+        ])("adds the receipt to $destinationId", ({ getEvent, destinationId }) => {
+            const event = getEvent();
            const userId = "@bob:example.org";
            const receiptType = ReceiptType.Read;

@@ -160,4 +220,42 @@ describe("Read receipt", () => {
            expect(content.thread_id).toEqual(destinationId);
        });
    });
+
+    describe("addReceiptToStructure", () => {
+        it("should not allow an older unthreaded receipt to clobber a `main` threaded one", () => {
+            const userId = client.getSafeUserId();
+            const room = new Room(ROOM_ID, client, userId);
+
+            const unthreadedReceipt: WrappedReceipt = {
+                eventId: "$olderEvent",
+                data: {
+                    ts: 1234567880,
+                },
+            };
+            const mainTimelineReceipt: WrappedReceipt = {
+                eventId: "$newerEvent",
+                data: {
+                    ts: 1234567890,
+                },
+            };
+
+            room.addReceiptToStructure(
+                mainTimelineReceipt.eventId,
+                ReceiptType.ReadPrivate,
+                userId,
+                mainTimelineReceipt.data,
+                false,
+            );
+            expect(room.getEventReadUpTo(userId)).toBe(mainTimelineReceipt.eventId);
+
+            room.addReceiptToStructure(
+                unthreadedReceipt.eventId,
+                ReceiptType.ReadPrivate,
+                userId,
+                unthreadedReceipt.data,
+                false,
+            );
+            expect(room.getEventReadUpTo(userId)).toBe(mainTimelineReceipt.eventId);
+        });
+    });
 });
@@ -96,7 +96,7 @@ describe("ECDHv2", function () {

            expect(aliceChecksum).toEqual(bobChecksum);

-            expect(alice.connect()).rejects.toThrow();
+            await expect(alice.connect()).rejects.toThrow();

            await alice.cancel(RendezvousFailureReason.Unknown);
            await bob.cancel(RendezvousFailureReason.Unknown);
@@ -120,9 +120,9 @@ describe("ECDHv2", function () {

            alice.close();

-            expect(alice.connect()).rejects.toThrow();
-            expect(alice.send({})).rejects.toThrow();
-            expect(alice.receive()).rejects.toThrow();
+            await expect(alice.connect()).rejects.toThrow();
+            await expect(alice.send({})).rejects.toThrow();
+            await expect(alice.receive()).rejects.toThrow();

            await alice.cancel(RendezvousFailureReason.Unknown);
            await bob.cancel(RendezvousFailureReason.Unknown);
@@ -146,10 +146,10 @@ describe("ECDHv2", function () {

            // send a message without encryption
            await aliceTransport.send({ iv: "dummy", ciphertext: "dummy" });
-            expect(bob.receive()).rejects.toThrow();

            await alice.cancel(RendezvousFailureReason.Unknown);
            await bob.cancel(RendezvousFailureReason.Unknown);
+            await expect(bob.receive()).rejects.toThrow();
        });

        it("ciphertext before set up", async function () {
@@ -164,9 +164,8 @@ describe("ECDHv2", function () {

            await bobTransport.send({ iv: "dummy", ciphertext: "dummy" });

-            expect(alice.receive()).rejects.toThrow();
-
            await alice.cancel(RendezvousFailureReason.Unknown);
+            await expect(alice.receive()).rejects.toThrow();
        });
    });
 });
@@ -172,7 +172,7 @@ describe("Rendezvous", function () {

        const cancelPromise = aliceRz.cancel(RendezvousFailureReason.UserDeclined);
        await httpBackend.flush("");
-        expect(cancelPromise).resolves.toBeUndefined();
+        await expect(cancelPromise).resolves.toBeUndefined();
        httpBackend.verifyNoOutstandingExpectation();
        httpBackend.verifyNoOutstandingRequests();

@@ -603,7 +603,7 @@ describe("Rendezvous", function () {

    it("device not online within timeout", async function () {
        const { aliceRz } = await completeLogin({});
-        expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow();
+        await expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow();
    });

    it("device appears online within timeout", async function () {
@@ -627,7 +627,7 @@ describe("Rendezvous", function () {
                getFingerprint: () => "bbbb",
            };
        }, 1500);
-        expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow();
+        await expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow();
    });

    it("mismatched device key", async function () {
@@ -636,6 +636,6 @@ describe("Rendezvous", function () {
                getFingerprint: () => "XXXX",
            },
        });
-        expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow(/different key/);
+        await expect(aliceRz.verifyNewDeviceOnExistingDevice(1000)).rejects.toThrow(/different key/);
    });
 });
@@ -95,10 +95,10 @@ describe("SimpleHttpRendezvousTransport", function () {
            httpBackend.verifyNoOutstandingExpectation();
        }
    }
-    it("should throw an error when no server available", function () {
+    it("should throw an error when no server available", async function () {
        const client = makeMockClient({ userId: "@alice:example.com", deviceId: "DEVICEID", msc3886Enabled: false });
        const simpleHttpTransport = new MSC3886SimpleHttpRendezvousTransport({ client, fetchFn });
-        expect(simpleHttpTransport.send({})).rejects.toThrow("Invalid rendezvous URI");
+        await expect(simpleHttpTransport.send({})).rejects.toThrow("Invalid rendezvous URI");
    });

    it("POST to fallback server", async function () {
@@ -130,7 +130,6 @@ describe("SimpleHttpRendezvousTransport", function () {
            fetchFn,
        });
        const prom = simpleHttpTransport.send({});
-        expect(prom).rejects.toThrow();
        httpBackend.when("POST", "https://fallbackserver/rz").response = {
            body: null,
            response: {
@@ -138,7 +137,7 @@ describe("SimpleHttpRendezvousTransport", function () {
                headers: {},
            },
        };
-        await httpBackend.flush("");
+        await Promise.all([expect(prom).rejects.toThrow(), httpBackend.flush("")]);
    });

    it("POST with absolute path response", async function () {
@@ -364,7 +363,7 @@ describe("SimpleHttpRendezvousTransport", function () {
            fallbackRzServer: "https://fallbackserver/rz",
            fetchFn,
        });
-        expect(simpleHttpTransport.details()).rejects.toThrow();
+        await expect(simpleHttpTransport.details()).rejects.toThrow();
    });

    it("send after cancelled", async function () {
@@ -375,7 +374,7 @@ describe("SimpleHttpRendezvousTransport", function () {
            fetchFn,
        });
        await simpleHttpTransport.cancel(RendezvousFailureReason.UserDeclined);
-        expect(simpleHttpTransport.send({})).resolves.toBeUndefined();
+        await expect(simpleHttpTransport.send({})).resolves.toBeUndefined();
    });

    it("receive before ready", async function () {
@@ -385,7 +384,7 @@ describe("SimpleHttpRendezvousTransport", function () {
            fallbackRzServer: "https://fallbackserver/rz",
            fetchFn,
        });
-        expect(simpleHttpTransport.receive()).rejects.toThrow();
+        await expect(simpleHttpTransport.receive()).rejects.toThrow();
    });

    it("404 failure callback", async function () {
@@ -398,7 +397,6 @@ describe("SimpleHttpRendezvousTransport", function () {
            onFailure,
        });

-        expect(simpleHttpTransport.send({ foo: "baa" })).resolves.toBeUndefined();
        httpBackend.when("POST", "https://fallbackserver/rz").response = {
            body: null,
            response: {
@@ -406,7 +404,10 @@ describe("SimpleHttpRendezvousTransport", function () {
                headers: {},
            },
        };
-        await httpBackend.flush("", 1);
+        await Promise.all([
+            expect(simpleHttpTransport.send({ foo: "baa" })).resolves.toBeUndefined(),
+            httpBackend.flush("", 1),
+        ]);
        expect(onFailure).toHaveBeenCalledWith(RendezvousFailureReason.Unknown);
    });

@@ -438,7 +439,6 @@ describe("SimpleHttpRendezvousTransport", function () {
        }
        {
            // GET with 404 to simulate expiry
-            expect(simpleHttpTransport.receive()).resolves.toBeUndefined();
            httpBackend.when("GET", "https://fallbackserver/rz/123").response = {
                body: { foo: "baa" },
                response: {
@@ -446,7 +446,7 @@ describe("SimpleHttpRendezvousTransport", function () {
                    headers: {},
                },
            };
-            await httpBackend.flush("");
+            await Promise.all([expect(simpleHttpTransport.receive()).resolves.toBeUndefined(), httpBackend.flush("")]);
            expect(onFailure).toHaveBeenCalledWith(RendezvousFailureReason.Expired);
        }
    });
@@ -0,0 +1,76 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import fetchMock from "fetch-mock-jest";
+
+import { EventType, MatrixClient, Room } from "../../src";
+import { RoomHierarchy } from "../../src/room-hierarchy";
+
+describe("RoomHierarchy", () => {
+    const roomId = "!room:server";
+    const client = new MatrixClient({ baseUrl: "https://server", userId: "@user:server" });
+
+    it("should load data from /hierarchy API", async () => {
+        const spy = fetchMock.getOnce(
+            `https://server/_matrix/client/v1/rooms/${encodeURIComponent(roomId)}/hierarchy?suggested_only=false`,
+            {
+                rooms: [],
+            },
+            { overwriteRoutes: true },
+        );
+
+        const room = new Room(roomId, client, client.getSafeUserId());
+        const hierarchy = new RoomHierarchy(room);
+        const res = await hierarchy.load();
+
+        expect(spy).toHaveBeenCalled();
+        expect(res).toHaveLength(0);
+    });
+
+    describe("itSuggested", () => {
+        it("should return true if a room is suggested", async () => {
+            const spy = fetchMock.getOnce(
+                `https://server/_matrix/client/v1/rooms/${encodeURIComponent(roomId)}/hierarchy?suggested_only=false`,
+                {
+                    rooms: [
+                        {
+                            children_state: [
+                                {
+                                    origin_server_ts: 111,
+                                    content: {
+                                        suggested: true,
+                                        via: ["matrix.org"],
+                                    },
+                                    type: EventType.SpaceChild,
+                                    state_key: "!child_room:server",
+                                },
+                            ],
+                            room_id: roomId,
+                        },
+                    ],
+                },
+                { overwriteRoutes: true },
+            );
+
+            const room = new Room(roomId, client, client.getSafeUserId());
+            const hierarchy = new RoomHierarchy(room);
+            await hierarchy.load();
+
+            expect(spy).toHaveBeenCalled();
+            expect(hierarchy.isSuggested(hierarchy.root.roomId, "!child_room:server")).toBeTruthy();
+        });
+    });
+});
@@ -2556,7 +2556,7 @@ describe("Room", function () {
                    next_batch: "start_token",
                });

-            let prom = emitPromise(room, ThreadEvent.New);
+            const prom = emitPromise(room, ThreadEvent.New);
            await room.addLiveEvents([randomMessage, threadRoot, threadResponse]);
            const thread: Thread = await prom;
            await emitPromise(room, ThreadEvent.Update);
@@ -2583,9 +2583,11 @@ describe("Room", function () {
                    },
                });

-            prom = emitPromise(room, ThreadEvent.Update);
-            await room.addLiveEvents([threadResponseEdit]);
-            await prom;
+            // XXX: If we add the relation to the thread response before the thread finishes fetching via /relations
+            // then the test will fail
+            await emitPromise(room, ThreadEvent.Update);
+            await emitPromise(room, ThreadEvent.Update);
+            await Promise.all([emitPromise(room, ThreadEvent.Update), room.addLiveEvents([threadResponseEdit])]);
            expect(thread.replyToEvent!.getContent().body).toBe(threadResponseEdit.getContent()["m.new_content"].body);
        });

@@ -2765,7 +2767,7 @@ describe("Room", function () {
                        "m.relations": {
                            "m.thread": {
                                latest_event: threadResponse2.event,
-                                count: 2,
+                                count: 1,
                                current_user_participated: true,
                            },
                        },
@@ -2809,11 +2811,10 @@ describe("Room", function () {
                    },
                });

-            prom = emitPromise(room, ThreadEvent.Update);
-            const threadResponse2Redaction = mkRedaction(threadResponse2);
-            await room.addLiveEvents([threadResponse2Redaction]);
-            await prom;
            await emitPromise(room, ThreadEvent.Update);
+            const threadResponse2Redaction = mkRedaction(threadResponse2);
+            await emitPromise(room, ThreadEvent.Update);
+            await room.addLiveEvents([threadResponse2Redaction]);
            expect(thread).toHaveLength(1);
            expect(thread.replyToEvent!.getId()).toBe(threadResponse1.getId());

@@ -2849,7 +2850,7 @@ describe("Room", function () {
        Thread.setServerSideSupport(FeatureSupport.Stable);
        const room = new Room(roomId, client, userA);

-        it("thread root and its relations&redactions should be in both", () => {
+        it("thread root and its relations&redactions should be in main timeline", () => {
            const randomMessage = mkMessage();
            const threadRoot = mkMessage();
            const threadResponse1 = mkThreadResponse(threadRoot);
@@ -2867,6 +2868,9 @@ describe("Room", function () {
                threadReaction2Redaction,
            ];

+            const thread = room.createThread(threadRoot.getId()!, threadRoot, [], false);
+            events.slice(1).forEach((ev) => ev.setThread(thread));
+
            expect(room.eventShouldLiveIn(randomMessage, events, roots).shouldLiveInRoom).toBeTruthy();
            expect(room.eventShouldLiveIn(randomMessage, events, roots).shouldLiveInThread).toBeFalsy();

@@ -2878,14 +2882,11 @@ describe("Room", function () {
            expect(room.eventShouldLiveIn(threadResponse1, events, roots).threadId).toBe(threadRoot.getId());

            expect(room.eventShouldLiveIn(threadReaction1, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(threadReaction1, events, roots).shouldLiveInThread).toBeTruthy();
-            expect(room.eventShouldLiveIn(threadReaction1, events, roots).threadId).toBe(threadRoot.getId());
+            expect(room.eventShouldLiveIn(threadReaction1, events, roots).shouldLiveInThread).toBeFalsy();
            expect(room.eventShouldLiveIn(threadReaction2, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(threadReaction2, events, roots).shouldLiveInThread).toBeTruthy();
-            expect(room.eventShouldLiveIn(threadReaction2, events, roots).threadId).toBe(threadRoot.getId());
+            expect(room.eventShouldLiveIn(threadReaction2, events, roots).shouldLiveInThread).toBeFalsy();
            expect(room.eventShouldLiveIn(threadReaction2Redaction, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(threadReaction2Redaction, events, roots).shouldLiveInThread).toBeTruthy();
-            expect(room.eventShouldLiveIn(threadReaction2Redaction, events, roots).threadId).toBe(threadRoot.getId());
+            expect(room.eventShouldLiveIn(threadReaction2Redaction, events, roots).shouldLiveInThread).toBeFalsy();
        });

        it("thread response and its relations&redactions should be only in thread timeline", () => {
@@ -2909,25 +2910,39 @@ describe("Room", function () {
            expect(room.eventShouldLiveIn(threadReaction2Redaction, events, roots).threadId).toBe(threadRoot.getId());
        });

-        it("reply to thread response and its relations&redactions should be only in main timeline", () => {
+        it("reply to thread response and its relations&redactions should be only in thread timeline", () => {
            const threadRoot = mkMessage();
-            const threadResponse1 = mkThreadResponse(threadRoot);
-            const reply1 = mkReply(threadResponse1);
-            const reaction1 = utils.mkReaction(reply1, room.client, userA, roomId);
-            const reaction2 = utils.mkReaction(reply1, room.client, userA, roomId);
-            const reaction2Redaction = mkRedaction(reply1);
+            const threadResp1 = mkThreadResponse(threadRoot);
+            const threadResp1Reply1 = mkReply(threadResp1);
+            const threadResp1Reply1Reaction1 = utils.mkReaction(threadResp1Reply1, room.client, userA, roomId);
+            const threadResp1Reply1Reaction2 = utils.mkReaction(threadResp1Reply1, room.client, userA, roomId);
+            const thResp1Rep1React2Redaction = mkRedaction(threadResp1Reply1);

            const roots = new Set([threadRoot.getId()!]);
-            const events = [threadRoot, threadResponse1, reply1, reaction1, reaction2, reaction2Redaction];
+            const events = [
+                threadRoot,
+                threadResp1,
+                threadResp1Reply1,
+                threadResp1Reply1Reaction1,
+                threadResp1Reply1Reaction2,
+                thResp1Rep1React2Redaction,
+            ];

-            expect(room.eventShouldLiveIn(reply1, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(reply1, events, roots).shouldLiveInThread).toBeFalsy();
-            expect(room.eventShouldLiveIn(reaction1, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(reaction1, events, roots).shouldLiveInThread).toBeFalsy();
-            expect(room.eventShouldLiveIn(reaction2, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(reaction2, events, roots).shouldLiveInThread).toBeFalsy();
-            expect(room.eventShouldLiveIn(reaction2Redaction, events, roots).shouldLiveInRoom).toBeTruthy();
-            expect(room.eventShouldLiveIn(reaction2Redaction, events, roots).shouldLiveInThread).toBeFalsy();
+            const thread = room.createThread(threadRoot.getId()!, threadRoot, [], false);
+            events.forEach((ev) => ev.setThread(thread));
+
+            expect(room.eventShouldLiveIn(threadResp1Reply1, events, roots).shouldLiveInRoom).toBeFalsy();
+            expect(room.eventShouldLiveIn(threadResp1Reply1, events, roots).shouldLiveInThread).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadResp1Reply1, events, roots).threadId).toBe(thread.id);
+            expect(room.eventShouldLiveIn(threadResp1Reply1Reaction1, events, roots).shouldLiveInRoom).toBeFalsy();
+            expect(room.eventShouldLiveIn(threadResp1Reply1Reaction1, events, roots).shouldLiveInThread).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadResp1Reply1Reaction1, events, roots).threadId).toBe(thread.id);
+            expect(room.eventShouldLiveIn(threadResp1Reply1Reaction2, events, roots).shouldLiveInRoom).toBeFalsy();
+            expect(room.eventShouldLiveIn(threadResp1Reply1Reaction2, events, roots).shouldLiveInThread).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadResp1Reply1Reaction2, events, roots).threadId).toBe(thread.id);
+            expect(room.eventShouldLiveIn(thResp1Rep1React2Redaction, events, roots).shouldLiveInRoom).toBeFalsy();
+            expect(room.eventShouldLiveIn(thResp1Rep1React2Redaction, events, roots).shouldLiveInThread).toBeTruthy();
+            expect(room.eventShouldLiveIn(thResp1Rep1React2Redaction, events, roots).threadId).toBe(thread.id);
        });

        it("reply to reply to thread root should only be in the main timeline", () => {
@@ -2939,12 +2954,40 @@ describe("Room", function () {
            const roots = new Set([threadRoot.getId()!]);
            const events = [threadRoot, threadResponse1, reply1, reply2];

+            const thread = room.createThread(threadRoot.getId()!, threadRoot, [], false);
+            threadResponse1.setThread(thread);
+
            expect(room.eventShouldLiveIn(reply1, events, roots).shouldLiveInRoom).toBeTruthy();
            expect(room.eventShouldLiveIn(reply1, events, roots).shouldLiveInThread).toBeFalsy();
            expect(room.eventShouldLiveIn(reply2, events, roots).shouldLiveInRoom).toBeTruthy();
            expect(room.eventShouldLiveIn(reply2, events, roots).shouldLiveInThread).toBeFalsy();
        });

+        it("edit to thread root should live in main timeline only", () => {
+            const threadRoot = mkMessage();
+            const threadResponse1 = mkThreadResponse(threadRoot);
+            const threadRootEdit = mkEdit(threadRoot);
+            threadRoot.makeReplaced(threadRootEdit);
+
+            const thread = room.createThread(threadRoot.getId()!, threadRoot, [threadResponse1], false);
+            threadResponse1.setThread(thread);
+            threadRootEdit.setThread(thread);
+
+            const roots = new Set([threadRoot.getId()!]);
+            const events = [threadRoot, threadResponse1, threadRootEdit];
+
+            expect(room.eventShouldLiveIn(threadRoot, events, roots).shouldLiveInRoom).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadRoot, events, roots).shouldLiveInThread).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadRoot, events, roots).threadId).toBe(threadRoot.getId());
+
+            expect(room.eventShouldLiveIn(threadResponse1, events, roots).shouldLiveInRoom).toBeFalsy();
+            expect(room.eventShouldLiveIn(threadResponse1, events, roots).shouldLiveInThread).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadResponse1, events, roots).threadId).toBe(threadRoot.getId());
+
+            expect(room.eventShouldLiveIn(threadRootEdit, events, roots).shouldLiveInRoom).toBeTruthy();
+            expect(room.eventShouldLiveIn(threadRootEdit, events, roots).shouldLiveInThread).toBeFalsy();
+        });
+
        it("should aggregate relations in thread event timeline set", async () => {
            Thread.setServerSideSupport(FeatureSupport.Stable);
            const threadRoot = mkMessage();
@@ -2976,6 +3019,14 @@ describe("Room", function () {
            expect(responseRelations![0][1].size).toEqual(1);
            expect(responseRelations![0][1].has(threadReaction)).toBeTruthy();
        });
+
+        it("a non-thread reply to an unknown parent event should live in the main timeline only", async () => {
+            const message = mkMessage(); // we do not add this message to any timelines
+            const reply = mkReply(message);
+
+            expect(room.eventShouldLiveIn(reply).shouldLiveInRoom).toBeTruthy();
+            expect(room.eventShouldLiveIn(reply).shouldLiveInThread).toBeFalsy();
+        });
    });

    describe("getEventReadUpTo()", () => {
@@ -3062,10 +3113,10 @@ describe("Room", function () {
                it("should give precedence to m.read.private", () => {
                    room.getReadReceiptForUserId = (userId, ignore, receiptType): WrappedReceipt | null => {
                        if (receiptType === ReceiptType.ReadPrivate) {
-                            return { eventId: "eventId1" } as WrappedReceipt;
+                            return { eventId: "eventId1", data: { ts: 123 } };
                        }
                        if (receiptType === ReceiptType.Read) {
-                            return { eventId: "eventId2" } as WrappedReceipt;
+                            return { eventId: "eventId2", data: { ts: 123 } };
                        }
                        return null;
                    };
@@ -15,10 +15,11 @@ limitations under the License.
 */

 import { Mocked } from "jest-mock";
-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

 import { CrossSigningIdentity } from "../../../src/rust-crypto/CrossSigningIdentity";
 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
+import { ServerSideSecretStorage } from "../../../src/secret-storage";

 describe("CrossSigningIdentity", () => {
    describe("bootstrapCrossSigning", () => {
@@ -31,6 +32,9 @@ describe("CrossSigningIdentity", () => {
        /** A mock OutgoingRequestProcessor which crossSigning is connected to */
        let outgoingRequestProcessor: Mocked<OutgoingRequestProcessor>;

+        /** A mock ServerSideSecretStorage which crossSigning is connected to */
+        let secretStorage: Mocked<ServerSideSecretStorage>;
+
        beforeEach(async () => {
            await RustSdkCryptoJs.initAsync();

@@ -44,7 +48,11 @@ describe("CrossSigningIdentity", () => {
                makeOutgoingRequest: jest.fn(),
            } as unknown as Mocked<OutgoingRequestProcessor>;

-            crossSigning = new CrossSigningIdentity(olmMachine, outgoingRequestProcessor);
+            secretStorage = {
+                get: jest.fn(),
+            } as unknown as Mocked<ServerSideSecretStorage>;
+
+            crossSigning = new CrossSigningIdentity(olmMachine, outgoingRequestProcessor, secretStorage, jest.fn());
        });

        it("should do nothing if keys are present on-device and in secret storage", async () => {
@@ -14,10 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 import fetchMock from "fetch-mock-jest";
 import { Mocked } from "jest-mock";
-import { KeysClaimRequest, UserId } from "@matrix-org/matrix-sdk-crypto-js";
+import { KeysClaimRequest, UserId } from "@matrix-org/matrix-sdk-crypto-wasm";

 import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
 import { KeyClaimManager } from "../../../src/rust-crypto/KeyClaimManager";
@@ -16,7 +16,7 @@ limitations under the License.

 import MockHttpBackend from "matrix-mock-request";
 import { Mocked } from "jest-mock";
-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
 import {
    KeysBackupRequest,
    KeysClaimRequest,
@@ -26,7 +26,7 @@ import {
    SignatureUploadRequest,
    SigningKeysUploadRequest,
    ToDeviceRequest,
-} from "@matrix-org/matrix-sdk-crypto-js";
+} from "@matrix-org/matrix-sdk-crypto-wasm";

 import { TypedEventEmitter } from "../../../src/models/typed-event-emitter";
 import { HttpApiEvent, HttpApiEventHandlerMap, MatrixHttpApi, UIAuthCallback } from "../../../src";
@@ -14,16 +14,17 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import "fake-indexeddb/auto";
-import { IDBFactory } from "fake-indexeddb";
-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
-import { KeysQueryRequest, OlmMachine } from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+import { KeysQueryRequest, OlmMachine } from "@matrix-org/matrix-sdk-crypto-wasm";
 import { Mocked } from "jest-mock";
 import fetchMock from "fetch-mock-jest";

 import { RustCrypto } from "../../../src/rust-crypto/rust-crypto";
 import { initRustCrypto } from "../../../src/rust-crypto";
 import {
+    CryptoEvent,
+    Device,
+    DeviceVerification,
    HttpApiEvent,
    HttpApiEventHandlerMap,
    IHttpOpts,
@@ -35,21 +36,18 @@ import {
 import { mkEvent } from "../../test-utils/test-utils";
 import { CryptoBackend } from "../../../src/common-crypto/CryptoBackend";
 import { IEventDecryptionResult } from "../../../src/@types/crypto";
-import { OutgoingRequest, OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
+import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
 import { ServerSideSecretStorage } from "../../../src/secret-storage";
-import { CryptoCallbacks, ImportRoomKeysOpts } from "../../../src/crypto-api";
+import { CryptoCallbacks, ImportRoomKeysOpts, VerificationRequest } from "../../../src/crypto-api";
 import * as testData from "../../test-utils/test-data";

-afterEach(() => {
-    // reset fake-indexeddb after each test, to make sure we don't leak connections
-    // cf https://github.com/dumbmatter/fakeIndexedDB#wipingresetting-the-indexeddb-for-a-fresh-state
-    // eslint-disable-next-line no-global-assign
-    indexedDB = new IDBFactory();
-});
-
 const TEST_USER = "@alice:example.com";
 const TEST_DEVICE_ID = "TEST_DEVICE";

+afterEach(() => {
+    fetchMock.reset();
+});
+
 describe("RustCrypto", () => {
    describe(".importRoomKeys and .exportRoomKeys", () => {
        let rustCrypto: RustCrypto;
@@ -149,9 +147,30 @@ describe("RustCrypto", () => {
            const res = await rustCrypto.preprocessToDeviceMessages(inputs);
            expect(res).toEqual(inputs);
        });
+
+        it("emits VerificationRequestReceived on incoming m.key.verification.request", async () => {
+            const toDeviceEvent = {
+                type: "m.key.verification.request",
+                content: {
+                    from_device: "testDeviceId",
+                    methods: ["m.sas.v1"],
+                    transaction_id: "testTxn",
+                    timestamp: Date.now() - 1000,
+                },
+                sender: "@user:id",
+            };
+
+            const onEvent = jest.fn();
+            rustCrypto.on(CryptoEvent.VerificationRequestReceived, onEvent);
+            await rustCrypto.preprocessToDeviceMessages([toDeviceEvent]);
+            expect(onEvent).toHaveBeenCalledTimes(1);
+
+            const [req]: [VerificationRequest] = onEvent.mock.lastCall;
+            expect(req.transactionId).toEqual("testTxn");
+        });
    });

-    it("getCrossSigningKeyId", async () => {
+    it("getCrossSigningKeyId when there is no cross signing keys", async () => {
        const rustCrypto = await makeTestRustCrypto();
        await expect(rustCrypto.getCrossSigningKeyId()).resolves.toBe(null);
    });
@@ -334,6 +353,60 @@ describe("RustCrypto", () => {
        });
    });

+    describe("setDeviceVerified", () => {
+        let rustCrypto: RustCrypto;
+
+        async function getTestDevice(): Promise<Device> {
+            const devices = await rustCrypto.getUserDeviceInfo([testData.TEST_USER_ID]);
+            return devices.get(testData.TEST_USER_ID)!.get(testData.TEST_DEVICE_ID)!;
+        }
+
+        beforeEach(async () => {
+            rustCrypto = await makeTestRustCrypto(
+                new MatrixHttpApi(new TypedEventEmitter<HttpApiEvent, HttpApiEventHandlerMap>(), {
+                    baseUrl: "http://server/",
+                    prefix: "",
+                    onlyData: true,
+                }),
+                testData.TEST_USER_ID,
+            );
+
+            fetchMock.post("path:/_matrix/client/v3/keys/upload", { one_time_key_counts: {} });
+            fetchMock.post("path:/_matrix/client/v3/keys/query", {
+                device_keys: {
+                    [testData.TEST_USER_ID]: {
+                        [testData.TEST_DEVICE_ID]: testData.SIGNED_TEST_DEVICE_DATA,
+                    },
+                },
+            });
+            // call onSyncCompleted to kick off the outgoingRequestLoop and download the device list.
+            rustCrypto.onSyncCompleted({});
+
+            // before the call, the device should be unverified.
+            const device = await getTestDevice();
+            expect(device.verified).toEqual(DeviceVerification.Unverified);
+        });
+
+        it("should throw an error for an unknown device", async () => {
+            await expect(rustCrypto.setDeviceVerified(testData.TEST_USER_ID, "xxy")).rejects.toThrow("Unknown device");
+        });
+
+        it("should mark an unverified device as verified", async () => {
+            await rustCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+
+            // and confirm that the device is now verified
+            expect((await getTestDevice()).verified).toEqual(DeviceVerification.Verified);
+        });
+
+        it("should mark a verified device as unverified", async () => {
+            await rustCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID);
+            expect((await getTestDevice()).verified).toEqual(DeviceVerification.Verified);
+
+            await rustCrypto.setDeviceVerified(testData.TEST_USER_ID, testData.TEST_DEVICE_ID, false);
+            expect((await getTestDevice()).verified).toEqual(DeviceVerification.Unverified);
+        });
+    });
+
    describe("getDeviceVerificationStatus", () => {
        let rustCrypto: RustCrypto;
        let olmMachine: Mocked<RustSdkCryptoJs.OlmMachine>;
@@ -377,60 +450,39 @@ describe("RustCrypto", () => {
        let rustCrypto: RustCrypto;

        beforeEach(async () => {
-            rustCrypto = await makeTestRustCrypto(undefined, testData.TEST_USER_ID);
-        });
-
-        afterEach(() => {
-            jest.useRealTimers();
-        });
-
-        it("returns false initially", async () => {
-            jest.useFakeTimers();
-            const prom = rustCrypto.userHasCrossSigningKeys();
-            // the getIdentity() request should wait for a /keys/query request to complete, but times out after 1500ms
-            await jest.advanceTimersByTimeAsync(2000);
-            await expect(prom).resolves.toBe(false);
-        });
-
-        it("returns false if there is no cross-signing identity", async () => {
-            // @ts-ignore private field
-            const olmMachine = rustCrypto.olmMachine;
-
-            const outgoingRequests: OutgoingRequest[] = await olmMachine.outgoingRequests();
-            // pick out the KeysQueryRequest, and respond to it with the device keys but *no* cross-signing keys.
-            const req = outgoingRequests.find((r) => r instanceof KeysQueryRequest)!;
-            await olmMachine.markRequestAsSent(
-                req.id!,
-                req.type,
-                JSON.stringify({
-                    device_keys: {
-                        [testData.TEST_USER_ID]: { [testData.TEST_DEVICE_ID]: testData.SIGNED_TEST_DEVICE_DATA },
-                    },
+            rustCrypto = await makeTestRustCrypto(
+                new MatrixHttpApi(new TypedEventEmitter<HttpApiEvent, HttpApiEventHandlerMap>(), {
+                    baseUrl: "http://server/",
+                    prefix: "",
+                    onlyData: true,
                }),
+                testData.TEST_USER_ID,
            );
+        });
+
+        it("throws an error if the fetch fails", async () => {
+            fetchMock.post("path:/_matrix/client/v3/keys/query", 400);
+            await expect(rustCrypto.userHasCrossSigningKeys()).rejects.toThrow("400 error");
+        });
+
+        it("returns false if the user has no cross-signing keys", async () => {
+            fetchMock.post("path:/_matrix/client/v3/keys/query", {
+                device_keys: {
+                    [testData.TEST_USER_ID]: { [testData.TEST_DEVICE_ID]: testData.SIGNED_TEST_DEVICE_DATA },
+                },
+            });

            await expect(rustCrypto.userHasCrossSigningKeys()).resolves.toBe(false);
        });

-        it("returns true if OlmMachine has a cross-signing identity", async () => {
-            // @ts-ignore private field
-            const olmMachine = rustCrypto.olmMachine;
+        it("returns true if the user has cross-signing keys", async () => {
+            fetchMock.post("path:/_matrix/client/v3/keys/query", {
+                device_keys: {
+                    [testData.TEST_USER_ID]: { [testData.TEST_DEVICE_ID]: testData.SIGNED_TEST_DEVICE_DATA },
+                },
+                ...testData.SIGNED_CROSS_SIGNING_KEYS_DATA,
+            });

-            const outgoingRequests: OutgoingRequest[] = await olmMachine.outgoingRequests();
-            // pick out the KeysQueryRequest, and respond to it with the cross-signing keys
-            const req = outgoingRequests.find((r) => r instanceof KeysQueryRequest)!;
-            await olmMachine.markRequestAsSent(
-                req.id!,
-                req.type,
-                JSON.stringify({
-                    device_keys: {
-                        [testData.TEST_USER_ID]: { [testData.TEST_DEVICE_ID]: testData.SIGNED_TEST_DEVICE_DATA },
-                    },
-                    ...testData.SIGNED_CROSS_SIGNING_KEYS_DATA,
-                }),
-            );
-
-            // ... and we should now have cross-signing keys.
            await expect(rustCrypto.userHasCrossSigningKeys()).resolves.toBe(true);
        });
    });
@@ -507,6 +559,32 @@ describe("RustCrypto", () => {
            );
        });
    });
+
+    describe("get|storeSessionBackupPrivateKey", () => {
+        it("can save and restore a key", async () => {
+            const key = "testtesttesttesttesttesttesttest";
+            const rustCrypto = await makeTestRustCrypto();
+            await rustCrypto.storeSessionBackupPrivateKey(new TextEncoder().encode(key));
+            const fetched = await rustCrypto.getSessionBackupPrivateKey();
+            expect(new TextDecoder().decode(fetched!)).toEqual(key);
+        });
+    });
+
+    describe("getActiveSessionBackupVersion", () => {
+        it("returns null", async () => {
+            const rustCrypto = await makeTestRustCrypto();
+            expect(await rustCrypto.getActiveSessionBackupVersion()).toBeNull();
+        });
+    });
+
+    describe("findVerificationRequestDMInProgress", () => {
+        it("throws an error if the userId is not provided", async () => {
+            const rustCrypto = await makeTestRustCrypto();
+            expect(() => rustCrypto.findVerificationRequestDMInProgress(testData.TEST_ROOM_ID)).toThrow(
+                "missing userId",
+            );
+        });
+    });
 });

 /** build a basic RustCrypto instance for testing
@@ -520,5 +598,5 @@ async function makeTestRustCrypto(
    secretStorage: ServerSideSecretStorage = {} as ServerSideSecretStorage,
    cryptoCallbacks: CryptoCallbacks = {} as CryptoCallbacks,
 ): Promise<RustCrypto> {
-    return await initRustCrypto(http, userId, deviceId, secretStorage, cryptoCallbacks);
+    return await initRustCrypto(http, userId, deviceId, secretStorage, cryptoCallbacks, null);
 }
@@ -0,0 +1,102 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+import { Mocked } from "jest-mock";
+
+import { RustVerificationRequest } from "../../../src/rust-crypto/verification";
+import { OutgoingRequestProcessor } from "../../../src/rust-crypto/OutgoingRequestProcessor";
+
+describe("VerificationRequest", () => {
+    describe("pending", () => {
+        let request: RustVerificationRequest;
+        let mockedInner: Mocked<RustSdkCryptoJs.VerificationRequest>;
+
+        beforeEach(() => {
+            mockedInner = makeMockedInner();
+            request = makeTestRequest(mockedInner);
+        });
+
+        it("returns true for a created request", () => {
+            expect(request.pending).toBe(true);
+        });
+
+        it("returns false for passive requests", () => {
+            mockedInner.isPassive.mockReturnValue(true);
+            expect(request.pending).toBe(false);
+        });
+
+        it("returns false for completed requests", () => {
+            mockedInner.phase.mockReturnValue(RustSdkCryptoJs.VerificationRequestPhase.Done);
+            expect(request.pending).toBe(false);
+        });
+
+        it("returns false for cancelled requests", () => {
+            mockedInner.phase.mockReturnValue(RustSdkCryptoJs.VerificationRequestPhase.Cancelled);
+            expect(request.pending).toBe(false);
+        });
+    });
+
+    describe("timeout", () => {
+        it("passes through the result", () => {
+            const mockedInner = makeMockedInner();
+            const request = makeTestRequest(mockedInner);
+            mockedInner.timeRemainingMillis.mockReturnValue(10_000);
+            expect(request.timeout).toEqual(10_000);
+        });
+    });
+
+    describe("startVerification", () => {
+        let request: RustVerificationRequest;
+
+        beforeEach(() => {
+            request = makeTestRequest();
+        });
+
+        it("does not permit methods other than SAS", async () => {
+            await expect(request.startVerification("m.reciprocate.v1")).rejects.toThrow(
+                "Unsupported verification method",
+            );
+        });
+
+        it("raises an error if starting verification does not produce a verifier", async () => {
+            await expect(request.startVerification("m.sas.v1")).rejects.toThrow(
+                "Still no verifier after startSas() call",
+            );
+        });
+    });
+});
+
+/** build a RustVerificationRequest with default parameters */
+function makeTestRequest(
+    inner?: RustSdkCryptoJs.VerificationRequest,
+    outgoingRequestProcessor?: OutgoingRequestProcessor,
+): RustVerificationRequest {
+    inner ??= makeMockedInner();
+    outgoingRequestProcessor ??= {} as OutgoingRequestProcessor;
+    return new RustVerificationRequest(inner, outgoingRequestProcessor, []);
+}
+
+/** Mock up a rust-side VerificationRequest */
+function makeMockedInner(): Mocked<RustSdkCryptoJs.VerificationRequest> {
+    return {
+        registerChangesCallback: jest.fn(),
+        startSas: jest.fn(),
+        phase: jest.fn().mockReturnValue(RustSdkCryptoJs.VerificationRequestPhase.Created),
+        isPassive: jest.fn().mockReturnValue(false),
+        timeRemainingMillis: jest.fn(),
+    } as unknown as Mocked<RustSdkCryptoJs.VerificationRequest>;
+}
@@ -278,7 +278,7 @@ describe("IndexedDBStore", () => {
            workerFactory: () => worker,
        });
        await store.startup();
-        await expect(store.destroy()).resolves;
+        await store.destroy();
        expect(terminate).toHaveBeenCalled();
    });
 });
@@ -38,8 +38,6 @@ import { mkMessage } from "../test-utils/test-utils";
 import { makeBeaconEvent } from "../test-utils/beacon";
 import { ReceiptType } from "../../src/@types/read_receipts";

-// TODO: Fix types throughout
-
 describe("utils", function () {
    describe("encodeParams", function () {
        it("should url encode and concat with &s", function () {
@@ -1607,7 +1607,7 @@ describe("Call", function () {
    it("throws when there is no error listener", async () => {
        call.off(CallEvent.Error, errorListener);

-        expect(call.placeVoiceCall()).rejects.toThrow();
+        await expect(call.placeVoiceCall()).rejects.toThrow();
    });

    describe("hasPeerConnection()", () => {
@@ -137,8 +137,8 @@ export enum PushRuleKind {

 export enum RuleId {
    Master = ".m.rule.master",
-    IsUserMention = ".org.matrix.msc3952.is_user_mention",
-    IsRoomMention = ".org.matrix.msc3952.is_room_mention",
+    IsUserMention = ".m.rule.is_user_mention",
+    IsRoomMention = ".m.rule.is_room_mention",
    ContainsDisplayName = ".m.rule.contains_display_name",
    ContainsUserName = ".m.rule.contains_user_name",
    AtRoomNotification = ".m.rule.roomnotif",
@@ -15,6 +15,7 @@ limitations under the License.
 */

 import { UnstableValue } from "../NamespacedValue";
+import { IClientWellKnown } from "../client";

 // disable lint because these are wire responses
 /* eslint-disable camelcase */
@@ -79,19 +80,6 @@ export interface IIdentityProvider {
    brand?: IdentityProviderBrand | string;
 }

-/**
- * Parameters to login request as per https://spec.matrix.org/v1.3/client-server-api/#login
- */
-/* eslint-disable camelcase */
-export interface ILoginParams {
-    identifier?: object;
-    password?: string;
-    token?: string;
-    device_id?: string;
-    initial_device_display_name?: string;
-}
-/* eslint-enable camelcase */
-
 export enum SSOAction {
    /** The user intends to login to an existing account */
    LOGIN = "login",
@@ -100,6 +88,160 @@ export enum SSOAction {
    REGISTER = "register",
 }

+/**
+ * A client can identify a user using their Matrix ID.
+ * This can either be the fully qualified Matrix user ID, or just the localpart of the user ID.
+ * @see https://spec.matrix.org/v1.7/client-server-api/#matrix-user-id
+ */
+type UserLoginIdentifier = {
+    type: "m.id.user";
+    user: string;
+};
+
+/**
+ * A client can identify a user using a 3PID associated with the user’s account on the homeserver,
+ * where the 3PID was previously associated using the /account/3pid API.
+ * See the 3PID Types Appendix for a list of Third-party ID media.
+ * @see https://spec.matrix.org/v1.7/client-server-api/#third-party-id
+ */
+type ThirdPartyLoginIdentifier = {
+    type: "m.id.thirdparty";
+    medium: string;
+    address: string;
+};
+
+/**
+ * A client can identify a user using a phone number associated with the user’s account,
+ * where the phone number was previously associated using the /account/3pid API.
+ * The phone number can be passed in as entered by the user; the homeserver will be responsible for canonicalising it.
+ * If the client wishes to canonicalise the phone number,
+ * then it can use the m.id.thirdparty identifier type with a medium of msisdn instead.
+ *
+ * The country is the two-letter uppercase ISO-3166-1 alpha-2 country code that the number in phone should be parsed as if it were dialled from.
+ *
+ * @see https://spec.matrix.org/v1.7/client-server-api/#phone-number
+ */
+type PhoneLoginIdentifier = {
+    type: "m.id.phone";
+    country: string;
+    phone: string;
+};
+
+type SpecUserIdentifier = UserLoginIdentifier | ThirdPartyLoginIdentifier | PhoneLoginIdentifier;
+
+/**
+ * User Identifiers usable for login & user-interactive authentication.
+ *
+ * Extensibly allows more than Matrix specified identifiers.
+ */
+export type UserIdentifier =
+    | SpecUserIdentifier
+    | { type: Exclude<string, SpecUserIdentifier["type"]>; [key: string]: any };
+
+/**
+ * Request body for POST /login request
+ * @see https://spec.matrix.org/v1.7/client-server-api/#post_matrixclientv3login
+ */
+export interface LoginRequest {
+    /**
+     * The login type being used.
+     */
+    type: "m.login.password" | "m.login.token" | string;
+    /**
+     * Third-party identifier for the user.
+     * @deprecated in favour of `identifier`.
+     */
+    address?: string;
+    /**
+     * ID of the client device.
+     * If this does not correspond to a known client device, a new device will be created.
+     * The given device ID must not be the same as a cross-signing key ID.
+     * The server will auto-generate a device_id if this is not specified.
+     */
+    device_id?: string;
+    /**
+     * Identification information for a user
+     */
+    identifier?: UserIdentifier;
+    /**
+     * A display name to assign to the newly-created device.
+     * Ignored if device_id corresponds to a known device.
+     */
+    initial_device_display_name?: string;
+    /**
+     * When logging in using a third-party identifier, the medium of the identifier.
+     * Must be `email`.
+     * @deprecated in favour of `identifier`.
+     */
+    medium?: "email";
+    /**
+     * Required when type is `m.login.password`. The user’s password.
+     */
+    password?: string;
+    /**
+     * If true, the client supports refresh tokens.
+     */
+    refresh_token?: boolean;
+    /**
+     * Required when type is `m.login.token`. Part of Token-based login.
+     */
+    token?: string;
+    /**
+     * The fully qualified user ID or just local part of the user ID, to log in.
+     * @deprecated in favour of identifier.
+     */
+    user?: string;
+    // Extensible
+    [key: string]: any;
+}
+
+// Export for backwards compatibility
+export type ILoginParams = LoginRequest;
+
+/**
+ * Response body for POST /login request
+ * @see https://spec.matrix.org/v1.7/client-server-api/#post_matrixclientv3login
+ */
+export interface LoginResponse {
+    /**
+     * An access token for the account.
+     * This access token can then be used to authorize other requests.
+     */
+    access_token: string;
+    /**
+     * ID of the logged-in device.
+     * Will be the same as the corresponding parameter in the request, if one was specified.
+     */
+    device_id: string;
+    /**
+     * The fully-qualified Matrix ID for the account.
+     */
+    user_id: string;
+    /**
+     * The lifetime of the access token, in milliseconds.
+     * Once the access token has expired a new access token can be obtained by using the provided refresh token.
+     * If no refresh token is provided, the client will need to re-log in to obtain a new access token.
+     * If not given, the client can assume that the access token will not expire.
+     */
+    expires_in_ms?: number;
+    /**
+     * A refresh token for the account.
+     * This token can be used to obtain a new access token when it expires by calling the /refresh endpoint.
+     */
+    refresh_token?: string;
+    /**
+     * Optional client configuration provided by the server.
+     * If present, clients SHOULD use the provided object to reconfigure themselves, optionally validating the URLs within.
+     * This object takes the same form as the one returned from .well-known autodiscovery.
+     */
+    well_known?: IClientWellKnown;
+    /**
+     * The server_name of the homeserver on which the account has been registered.
+     * @deprecated Clients should extract the server_name from user_id (by splitting at the first colon) if they require it.
+     */
+    home_server?: string;
+}
+
 /**
 * The result of a successful [MSC3882](https://github.com/matrix-org/matrix-spec-proposals/pull/3882)
 * `m.login.token` issuance request.
@@ -96,4 +96,20 @@ declare global {
        // but we still need this for MatrixCall::getRidOfRTXCodecs()
        setCodecPreferences(codecs: RTCRtpCodecCapability[]): void;
    }
+
+    interface RequestInit {
+        /**
+         * Specifies the priority of the fetch request relative to other requests of the same type.
+         * Must be one of the following strings:
+         *   high: A high priority fetch request relative to other requests of the same type.
+         *   low: A low priority fetch request relative to other requests of the same type.
+         *   auto: Automatically determine the priority of the fetch request relative to other requests of the same type (default).
+         *
+         * @see https://html.spec.whatwg.org/multipage/urls-and-fetching.html#fetch-priority-attribute
+         * @see https://github.com/microsoft/TypeScript/issues/54472
+         * @see https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API#browser_compatibility
+         * Not yet supported in Safari or Firefox
+         */
+        priority?: "high" | "low" | "auto";
+    }
 }
@@ -0,0 +1,116 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { AuthDict } from "../interactive-auth";
+
+/**
+ * The request body of a call to `POST /_matrix/client/v3/register`.
+ *
+ * @see https://spec.matrix.org/v1.7/client-server-api/#post_matrixclientv3register
+ */
+export interface RegisterRequest {
+    /**
+     * Additional authentication information for the user-interactive authentication API.
+     * Note that this information is not used to define how the registered user should be authenticated,
+     * but is instead used to authenticate the register call itself.
+     */
+    auth?: AuthDict;
+    /**
+     * The basis for the localpart of the desired Matrix ID.
+     * If omitted, the homeserver MUST generate a Matrix ID local part.
+     */
+    username?: string;
+    /**
+     * The desired password for the account.
+     */
+    password?: string;
+    /**
+     * If true, the client supports refresh tokens.
+     */
+    refresh_token?: boolean;
+    /**
+     * If true, an access_token and device_id should not be returned from this call, therefore preventing an automatic login.
+     * Defaults to false.
+     */
+    inhibit_login?: boolean;
+    /**
+     * A display name to assign to the newly-created device.
+     * Ignored if device_id corresponds to a known device.
+     */
+    initial_device_display_name?: string;
+    /**
+     * @deprecated missing in the spec
+     */
+    guest_access_token?: string;
+    /**
+     * @deprecated missing in the spec
+     */
+    x_show_msisdn?: boolean;
+    /**
+     * @deprecated missing in the spec
+     */
+    bind_msisdn?: boolean;
+    /**
+     * @deprecated missing in the spec
+     */
+    bind_email?: boolean;
+}
+
+/**
+ * The result of a successful call to `POST /_matrix/client/v3/register`.
+ *
+ * @see https://spec.matrix.org/v1.7/client-server-api/#post_matrixclientv3register
+ */
+export interface RegisterResponse {
+    /**
+     * The fully-qualified Matrix user ID (MXID) that has been registered.
+     */
+    user_id: string;
+    /**
+     * An access token for the account.
+     * This access token can then be used to authorize other requests.
+     * Required if the inhibit_login option is false.
+     */
+    access_token?: string;
+    /**
+     * ID of the registered device.
+     * Will be the same as the corresponding parameter in the request, if one was specified.
+     * Required if the inhibit_login option is false.
+     */
+    device_id?: string;
+    /**
+     * The lifetime of the access token, in milliseconds.
+     * Once the access token has expired a new access token can be obtained by using the provided refresh token.
+     * If no refresh token is provided, the client will need to re-log in to obtain a new access token.
+     * If not given, the client can assume that the access token will not expire.
+     *
+     * Omitted if the inhibit_login option is true.
+     */
+    expires_in_ms?: number;
+    /**
+     * A refresh token for the account.
+     * This token can be used to obtain a new access token when it expires by calling the /refresh endpoint.
+     *
+     * Omitted if the inhibit_login option is true.
+     */
+    refresh_token?: string;
+    /**
+     * The server_name of the homeserver on which the account has been registered.
+     *
+     * @deprecated Clients should extract the server_name from user_id (by splitting at the first colon) if they require it.
+     */
+    home_server?: string;
+}
@@ -45,6 +45,18 @@ export interface IJoinRoomOpts {
    viaServers?: string[];
 }

+export interface KnockRoomOpts {
+    /**
+     * The reason for the knock.
+     */
+    reason?: string;
+
+    /**
+     * The server names to try and knock through in addition to those that are automatically chosen.
+     */
+    viaServers?: string | string[];
+}
+
 export interface IRedactOpts {
    reason?: string;
    /**
@@ -176,7 +188,14 @@ export interface IAddThreePidOnlyBody {
 export interface IBindThreePidBody {
    client_secret: string;
    id_server: string;
-    id_access_token: string;
+    // Some older identity servers have no auth enabled
+    id_access_token: string | null;
+    sid: string;
+}
+
+export interface IAddThreePidBody {
+    client_secret: string;
+    id_server: string;
    sid: string;
 }

@@ -15,10 +15,18 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import { SigningKey } from "oidc-client-ts";
+
 import { IClientWellKnown, IWellKnownConfig, IDelegatedAuthConfig, IServerVersions, M_AUTHENTICATION } from "./client";
 import { logger } from "./logger";
 import { MatrixError, Method, timeoutSignal } from "./http-api";
-import { ValidatedIssuerConfig, validateOIDCIssuerWellKnown, validateWellKnownAuthentication } from "./oidc/validate";
+import { discoverAndValidateAuthenticationConfig } from "./oidc/discovery";
+import {
+    ValidatedIssuerConfig,
+    ValidatedIssuerMetadata,
+    validateOIDCIssuerWellKnown,
+    validateWellKnownAuthentication,
+} from "./oidc/validate";
 import { OidcError } from "./oidc/error";

 // Dev note: Auto discovery is part of the spec.
@@ -50,12 +58,26 @@ interface AutoDiscoveryState {
 }
 interface WellKnownConfig extends Omit<IWellKnownConfig, "error">, AutoDiscoveryState {}

+/**
+ * @deprecated in favour of OidcClientConfig
+ */
 interface DelegatedAuthConfig extends IDelegatedAuthConfig, ValidatedIssuerConfig, AutoDiscoveryState {}

+/**
+ * @experimental
+ */
+export interface OidcClientConfig extends IDelegatedAuthConfig, ValidatedIssuerConfig {
+    metadata: ValidatedIssuerMetadata;
+    signingKeys?: SigningKey[];
+}
+
 export interface ClientConfig extends Omit<IClientWellKnown, "m.homeserver" | "m.identity_server"> {
    "m.homeserver": WellKnownConfig;
    "m.identity_server": WellKnownConfig;
-    "m.authentication"?: DelegatedAuthConfig | AutoDiscoveryState;
+    /**
+     * @experimental
+     */
+    "m.authentication"?: (OidcClientConfig & AutoDiscoveryState) | AutoDiscoveryState;
 }

 /**
@@ -262,7 +284,7 @@ export class AutoDiscovery {
            }
        });

-        const authConfig = await this.validateDiscoveryAuthenticationConfig(wellknown);
+        const authConfig = await this.discoverAndValidateAuthenticationConfig(wellknown);
        clientConfig[M_AUTHENTICATION.stable!] = authConfig;

        // Step 8: Give the config to the caller (finally)
@@ -271,6 +293,7 @@ export class AutoDiscovery {

    /**
     * Validate delegated auth configuration
+     * @deprecated use discoverAndValidateAuthenticationConfig
     * - m.authentication config is present and valid
     * - delegated auth issuer openid-configuration is reachable
     * - delegated auth issuer openid-configuration is configured correctly for us
@@ -284,7 +307,8 @@ export class AutoDiscovery {
        wellKnown: IClientWellKnown,
    ): Promise<DelegatedAuthConfig | AutoDiscoveryState> {
        try {
-            const homeserverAuthenticationConfig = validateWellKnownAuthentication(wellKnown);
+            const authentication = M_AUTHENTICATION.findIn<IDelegatedAuthConfig>(wellKnown) || undefined;
+            const homeserverAuthenticationConfig = validateWellKnownAuthentication(authentication);

            const issuerOpenIdConfigUrl = `${this.sanitizeWellKnownUrl(
                homeserverAuthenticationConfig.issuer,
@@ -319,6 +343,48 @@ export class AutoDiscovery {
        }
    }

+    /**
+     * Validate delegated auth configuration
+     * - m.authentication config is present and valid
+     * - delegated auth issuer openid-configuration is reachable
+     * - delegated auth issuer openid-configuration is configured correctly for us
+     * When successful, validated authentication metadata and optionally signing keys will be returned
+     * Any errors are caught, and AutoDiscoveryState returned with error
+     * @param wellKnown - configuration object as returned
+     * by the .well-known auto-discovery endpoint
+     * @returns Config or failure result
+     */
+    public static async discoverAndValidateAuthenticationConfig(
+        wellKnown: IClientWellKnown,
+    ): Promise<(OidcClientConfig & AutoDiscoveryState) | AutoDiscoveryState> {
+        try {
+            const authentication = M_AUTHENTICATION.findIn<IDelegatedAuthConfig>(wellKnown) || undefined;
+            const result = await discoverAndValidateAuthenticationConfig(authentication);
+
+            // include this for backwards compatibility
+            const validatedIssuerConfig = validateOIDCIssuerWellKnown(result.metadata);
+
+            const response = {
+                state: AutoDiscoveryAction.SUCCESS,
+                error: null,
+                ...validatedIssuerConfig,
+                ...result,
+            };
+            return response;
+        } catch (error) {
+            const errorMessage = (error as Error).message as unknown as OidcError;
+            const errorType = Object.values(OidcError).includes(errorMessage) ? errorMessage : OidcError.General;
+
+            const state =
+                errorType === OidcError.NotSupported ? AutoDiscoveryAction.IGNORE : AutoDiscoveryAction.FAIL_ERROR;
+
+            return {
+                state,
+                error: errorType,
+            };
+        }
+    }
+
    /**
     * Attempts to automatically discover client configuration information
     * prior to logging in. Such information includes the homeserver URL
@@ -21,7 +21,7 @@ limitations under the License.
 import { Optional } from "matrix-events-sdk";

 import type { IDeviceKeys, IMegolmSessionData, IOneTimeKey } from "./@types/crypto";
-import { ISyncStateData, SyncApi, SyncApiOptions, SyncState } from "./sync";
+import { ISyncStateData, SetPresence, SyncApi, SyncApiOptions, SyncState } from "./sync";
 import {
    EventStatus,
    IContent,
@@ -71,6 +71,7 @@ import {
    UploadResponse,
    HTTPError,
    IRequestOpts,
+    Body,
 } from "./http-api";
 import {
    Crypto,
@@ -101,7 +102,7 @@ import {
 import { IIdentityServerProvider } from "./@types/IIdentityServerProvider";
 import { MatrixScheduler } from "./scheduler";
 import { BeaconEvent, BeaconEventHandlerMap } from "./models/beacon";
-import { IAuthData, IAuthDict } from "./interactive-auth";
+import { AuthDict } from "./interactive-auth";
 import { IMinimalEvent, IRoomEvent, IStateEvent } from "./sync-accumulator";
 import { CrossSigningKey, ICreateSecretStorageOpts, IEncryptedEventInfo, IRecoveryKey } from "./crypto/api";
 import { EventTimelineSet } from "./models/event-timeline-set";
@@ -111,7 +112,7 @@ import * as ContentHelpers from "./content-helpers";
 import { CrossSigningInfo, DeviceTrustLevel, ICacheCallbacks, UserTrustLevel } from "./crypto/CrossSigning";
 import { Room, NotificationCountType, RoomEvent, RoomEventHandlerMap, RoomNameState } from "./models/room";
 import { RoomMemberEvent, RoomMemberEventHandlerMap } from "./models/room-member";
-import { RoomStateEvent, RoomStateEventHandlerMap } from "./models/room-state";
+import { IPowerLevelsContent, RoomStateEvent, RoomStateEventHandlerMap } from "./models/room-state";
 import {
    IAddThreePidOnlyBody,
    IBindThreePidBody,
@@ -132,6 +133,8 @@ import {
    IFilterResponse,
    ITagsResponse,
    IStatusResponse,
+    IAddThreePidBody,
+    KnockRoomOpts,
 } from "./@types/requests";
 import {
    EventType,
@@ -178,7 +181,14 @@ import { IThreepid } from "./@types/threepids";
 import { CryptoStore, OutgoingRoomKeyRequest } from "./crypto/store/base";
 import { GroupCall, IGroupCallDataChannelOptions, GroupCallIntent, GroupCallType } from "./webrtc/groupCall";
 import { MediaHandler } from "./webrtc/mediaHandler";
-import { LoginTokenPostResponse, ILoginFlowsResponse, IRefreshTokenResponse, SSOAction } from "./@types/auth";
+import {
+    LoginTokenPostResponse,
+    ILoginFlowsResponse,
+    IRefreshTokenResponse,
+    SSOAction,
+    LoginResponse,
+    LoginRequest,
+} from "./@types/auth";
 import { TypedEventEmitter } from "./models/typed-event-emitter";
 import { MAIN_ROOM_TIMELINE, ReceiptType } from "./@types/read_receipts";
 import { MSC3575SlidingSyncRequest, MSC3575SlidingSyncResponse, SlidingSync } from "./sliding-sync";
@@ -201,7 +211,7 @@ import { LocalNotificationSettings } from "./@types/local_notifications";
 import { buildFeatureSupportMap, Feature, ServerSupport } from "./feature";
 import { CryptoBackend } from "./common-crypto/CryptoBackend";
 import { RUST_SDK_STORE_PREFIX } from "./rust-crypto/constants";
-import { BootstrapCrossSigningOpts, CryptoApi, ImportRoomKeysOpts } from "./crypto-api";
+import { BootstrapCrossSigningOpts, CrossSigningKeyInfo, CryptoApi, ImportRoomKeysOpts } from "./crypto-api";
 import { DeviceInfoMap } from "./crypto/DeviceList";
 import {
    AddSecretStorageKeyOpts,
@@ -209,6 +219,7 @@ import {
    ServerSideSecretStorage,
    ServerSideSecretStorageImpl,
 } from "./secret-storage";
+import { RegisterRequest, RegisterResponse } from "./@types/registration";

 export type Store = IStore;

@@ -514,13 +525,8 @@ export interface Capabilities {
    [UNSTABLE_MSC3882_CAPABILITY.altName]?: IMSC3882GetLoginTokenCapability;
 }

-/* eslint-disable camelcase */
-export interface ICrossSigningKey {
-    keys: { [algorithm: string]: string };
-    signatures?: ISignatures;
-    usage: string[];
-    user_id: string;
-}
+/** @deprecated prefer {@link CrossSigningKeyInfo}. */
+export type ICrossSigningKey = CrossSigningKeyInfo;

 enum CrossSigningKeyType {
    MasterKey = "master_key",
@@ -717,18 +723,8 @@ interface IJoinedMembersResponse {
    };
 }

-export interface IRegisterRequestParams {
-    auth?: IAuthDict;
-    username?: string;
-    password?: string;
-    refresh_token?: boolean;
-    guest_access_token?: string;
-    x_show_msisdn?: boolean;
-    bind_msisdn?: boolean;
-    bind_email?: boolean;
-    inhibit_login?: boolean;
-    initial_device_display_name?: string;
-}
+// Re-export for backwards compatibility
+export type IRegisterRequestParams = RegisterRequest;

 export interface IPublicRoomsChunkRoom {
    room_id: string;
@@ -924,6 +920,7 @@ type CryptoEvents =
    | CryptoEvent.RoomKeyRequest
    | CryptoEvent.RoomKeyRequestCancellation
    | CryptoEvent.VerificationRequest
+    | CryptoEvent.VerificationRequestReceived
    | CryptoEvent.DeviceVerificationChanged
    | CryptoEvent.UserTrustStatusChanged
    | CryptoEvent.KeysChanged
@@ -2013,12 +2010,11 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * Set whether this client is a guest account. <b>This method is experimental
     * and may change without warning.</b>
     * @param guest - True if this is a guest account.
+     * @experimental if the token is a macaroon, it should be encoded in it that it is a 'guest'
+     * access token, which means that the SDK can determine this entirely without
+     * the dev manually flipping this flag.
     */
    public setGuest(guest: boolean): void {
-        // EXPERIMENTAL:
-        // If the token is a macaroon, it should be encoded in it that it is a 'guest'
-        // access token, which means that the SDK can determine this entirely without
-        // the dev manually flipping this flag.
        this.isGuestAccount = guest;
    }

@@ -2205,10 +2201,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *
     * @experimental
     *
+     * @param useIndexedDB - True to use an indexeddb store, false to use an in-memory store. Defaults to 'true'.
+     *
     * @returns a Promise which will resolve when the crypto layer has been
     *    successfully initialised.
     */
-    public async initRustCrypto(): Promise<void> {
+    public async initRustCrypto({ useIndexedDB = true }: { useIndexedDB?: boolean } = {}): Promise<void> {
        if (this.cryptoBackend) {
            logger.warn("Attempt to re-initialise e2e encryption on MatrixClient");
            return;
@@ -2238,13 +2236,23 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            deviceId,
            this.secretStorage,
            this.cryptoCallbacks,
+            useIndexedDB ? RUST_SDK_STORE_PREFIX : null,
        );
-        rustCrypto.supportedVerificationMethods = this.verificationMethods;
+        rustCrypto.setSupportedVerificationMethods(this.verificationMethods);

        this.cryptoBackend = rustCrypto;

        // attach the event listeners needed by RustCrypto
        this.on(RoomMemberEvent.Membership, rustCrypto.onRoomMembership.bind(rustCrypto));
+        this.on(ClientEvent.Event, (event) => {
+            rustCrypto.onLiveEventFromSync(event);
+        });
+
+        // re-emit the events emitted by the crypto impl
+        this.reEmitter.reEmit(rustCrypto, [
+            CryptoEvent.VerificationRequestReceived,
+            CryptoEvent.UserTrustStatusChanged,
+        ]);
    }

    /**
@@ -2673,12 +2681,14 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * Check the copy of our cross-signing key that we have in the device list and
     * see if we can get the private key. If so, mark it as trusted.
     * @param opts - ICheckOwnCrossSigningTrustOpts object
+     *
+     * @deprecated Unneeded for the new crypto
     */
    public checkOwnCrossSigningTrust(opts?: ICheckOwnCrossSigningTrustOpts): Promise<void> {
-        if (!this.crypto) {
+        if (!this.cryptoBackend) {
            throw new Error("End-to-end encryption disabled");
        }
-        return this.crypto.checkOwnCrossSigningTrust(opts);
+        return this.cryptoBackend.checkOwnCrossSigningTrust(opts);
    }

    /**
@@ -2849,12 +2859,14 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Object with public key metadata, encoded private
     *     recovery key which should be disposed of after displaying to the user,
     *     and raw private key to avoid round tripping if needed.
+     *
+     * @deprecated Prefer {@link CryptoApi.createRecoveryKeyFromPassphrase | `CryptoApi.createRecoveryKeyFromPassphrase`}.
     */
    public createRecoveryKeyFromPassphrase(password?: string): Promise<IRecoveryKey> {
-        if (!this.crypto) {
+        if (!this.cryptoBackend) {
            throw new Error("End-to-end encryption disabled");
        }
-        return this.crypto.createRecoveryKeyFromPassphrase(password);
+        return this.cryptoBackend.createRecoveryKeyFromPassphrase(password);
    }

    /**
@@ -2869,7 +2881,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * return true.
     *
     * @returns True if secret storage is ready to be used on this device
-     * @deprecated Prefer {@link CryptoApi.isSecretStorageReady | `CryptoApi.isSecretStorageReady`}:
+     * @deprecated Prefer {@link CryptoApi.isSecretStorageReady | `CryptoApi.isSecretStorageReady`}.
     */
    public isSecretStorageReady(): Promise<boolean> {
        if (!this.cryptoBackend) {
@@ -2891,13 +2903,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * - migrates Secure Secret Storage to use the latest algorithm, if an outdated
     *   algorithm is found
     *
-     * @deprecated Use {@link CryptoApi#bootstrapSecretStorage}.
+     * @deprecated Use {@link CryptoApi.bootstrapSecretStorage | `CryptoApi.bootstrapSecretStorage`}.
     */
    public bootstrapSecretStorage(opts: ICreateSecretStorageOpts): Promise<void> {
-        if (!this.crypto) {
+        if (!this.cryptoBackend) {
            throw new Error("End-to-end encryption disabled");
        }
-        return this.crypto.bootstrapSecretStorage(opts);
+        return this.cryptoBackend.bootstrapSecretStorage(opts);
    }

    /**
@@ -3274,6 +3286,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    /**
     * @param info - key backup info dict from getKeyBackupVersion()
+     *
+     * @deprecated Prefer {@link CryptoApi.isKeyBackupTrusted | `CryptoApi.isKeyBackupTrusted`}.
     */
    public isKeyBackupTrusted(info: IKeyBackupInfo): Promise<TrustInfo> {
        if (!this.crypto) {
@@ -3286,6 +3300,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns true if the client is configured to back up keys to
     *     the server, otherwise false. If we haven't completed a successful check
     *     of key backup status yet, returns null.
+     *
+     * @deprecated Prefer direct access to {@link CryptoApi.getActiveSessionBackupVersion}:
+     *
+     * ```javascript
+     * let enabled = (await client.getCrypto().getActiveSessionBackupVersion()) !== null;
+     * ```
     */
    public getKeyBackupEnabled(): boolean | null {
        if (!this.crypto) {
@@ -3428,6 +3448,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        // If we're currently backing up to this backup... stop.
        // (We start using it automatically in createKeyBackupVersion
        // so this is symmetrical).
+        // TODO: convert this to use crypto.getActiveSessionBackupVersion. And actually check the version.
        if (this.crypto.backupManager.version) {
            this.crypto.backupManager.disableKeyBackup();
        }
@@ -3713,10 +3734,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        backupInfo: IKeyBackupInfo,
        opts?: IKeyBackupRestoreOpts,
    ): Promise<IKeyBackupRestoreResult> {
-        if (!this.crypto) {
+        if (!this.cryptoBackend) {
            throw new Error("End-to-end encryption disabled");
        }
-        const privKey = await this.crypto.getSessionBackupPrivateKey();
+        const privKey = await this.cryptoBackend.getSessionBackupPrivateKey();
        if (!privKey) {
            throw new Error("Couldn't get key");
        }
@@ -3754,7 +3775,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        const cacheCompleteCallback = opts?.cacheCompleteCallback;
        const progressCallback = opts?.progressCallback;

-        if (!this.crypto) {
+        if (!this.cryptoBackend) {
            throw new Error("End-to-end encryption disabled");
        }

@@ -3777,9 +3798,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
                return Promise.reject(new MatrixError({ errcode: MatrixClient.RESTORE_BACKUP_ERROR_BAD_KEY }));
            }

+            if (!(privKey instanceof Uint8Array)) {
+                // eslint-disable-next-line @typescript-eslint/no-base-to-string
+                throw new Error(`restoreKeyBackup expects Uint8Array, got ${privKey}`);
+            }
            // Cache the key, if possible.
            // This is async.
-            this.crypto
+            this.cryptoBackend
                .storeSessionBackupPrivateKey(privKey)
                .catch((e) => {
                    logger.warn("Error caching session backup key:", e);
@@ -3836,7 +3861,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            algorithm.free();
        }

-        await this.getCrypto()?.importRoomKeys(keys, {
+        await this.cryptoBackend.importRoomKeys(keys, {
            progressCallback,
            untrusted,
            source: "backup",
@@ -4134,6 +4159,34 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return syncRoom;
    }

+    /**
+     * Knock a room. If you have already knocked the room, this will no-op.
+     * @param roomIdOrAlias - The room ID or room alias to knock.
+     * @param opts - Options when knocking the room.
+     * @returns Promise which resolves: `{room_id: {string}}`
+     * @returns Rejects: with an error response.
+     */
+    public knockRoom(roomIdOrAlias: string, opts: KnockRoomOpts = {}): Promise<{ room_id: string }> {
+        const room = this.getRoom(roomIdOrAlias);
+        if (room?.hasMembershipState(this.credentials.userId!, "knock")) {
+            return Promise.resolve({ room_id: room.roomId });
+        }
+
+        const path = utils.encodeUri("/knock/$roomIdOrAlias", { $roomIdOrAlias: roomIdOrAlias });
+
+        const queryParams: Record<string, string | string[]> = {};
+        if (opts.viaServers) {
+            queryParams.server_name = opts.viaServers;
+        }
+
+        const body: Record<string, string> = {};
+        if (opts.reason) {
+            body.reason = opts.reason;
+        }
+
+        return this.http.authedRequest(Method.Post, path, queryParams, body);
+    }
+
    /**
     * Resend an event. Will also retry any to-device messages waiting to be sent.
     * @param event - The event to resend.
@@ -4251,24 +4304,48 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    /**
     * Set a power level to one or multiple users.
+     * Will apply changes atop of current power level event from local state if running & synced, falling back
+     * to fetching latest from the `/state/` API.
+     * @param roomId - the room to update power levels in
+     * @param userId - the ID of the user or users to update power levels of
+     * @param powerLevel - the numeric power level to update given users to
+     * @param event - deprecated and no longer used.
     * @returns Promise which resolves: to an ISendEventResponse object
     * @returns Rejects: with an error response.
     */
-    public setPowerLevel(
+    public async setPowerLevel(
        roomId: string,
        userId: string | string[],
        powerLevel: number | undefined,
-        event: MatrixEvent | null,
+        /**
+         * @deprecated no longer needed, unused.
+         */
+        event?: MatrixEvent | null,
    ): Promise<ISendEventResponse> {
-        let content = {
-            users: {} as Record<string, number>,
-        };
-        if (event?.getType() === EventType.RoomPowerLevels) {
-            // take a copy of the content to ensure we don't corrupt
-            // existing client state with a failed power level change
-            content = utils.deepCopy(event.getContent());
+        let content: IPowerLevelsContent | undefined;
+        if (this.clientRunning && this.isInitialSyncComplete()) {
+            content = this.getRoom(roomId)?.currentState?.getStateEvents(EventType.RoomPowerLevels, "")?.getContent();
+        }
+        if (!content) {
+            try {
+                content = await this.getStateEvent(roomId, EventType.RoomPowerLevels, "");
+            } catch (e) {
+                // It is possible for a Matrix room to not have a power levels event
+                if (e instanceof MatrixError && e.errcode === "M_NOT_FOUND") {
+                    content = {};
+                } else {
+                    throw e;
+                }
+            }
        }

+        // take a copy of the content to ensure we don't corrupt
+        // existing client state with a failed power level change
+        content = utils.deepCopy(content);
+
+        if (!content?.users) {
+            content.users = {};
+        }
        const users = Array.isArray(userId) ? userId : [userId];
        for (const user of users) {
            if (powerLevel == null) {
@@ -4278,10 +4355,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            }
        }

-        const path = utils.encodeUri("/rooms/$roomId/state/m.room.power_levels", {
-            $roomId: roomId,
-        });
-        return this.http.authedRequest(Method.Put, path, undefined, content);
+        return this.sendStateEvent(roomId, EventType.RoomPowerLevels, content, "");
    }

    /**
@@ -4377,7 +4451,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    private sendCompleteEvent(
        roomId: string,
        threadId: string | null,
-        eventObject: any,
+        eventObject: Partial<IEvent>,
        txnId?: string,
    ): Promise<ISendEventResponse> {
        if (!txnId) {
@@ -4954,7 +5028,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: to an empty object `{}`
     * @returns Rejects: with an error response.
     */
-    public async sendReceipt(event: MatrixEvent, receiptType: ReceiptType, body: any, unthreaded = false): Promise<{}> {
+    public async sendReceipt(
+        event: MatrixEvent,
+        receiptType: ReceiptType,
+        body?: Record<string, any>,
+        unthreaded = false,
+    ): Promise<{}> {
        if (this.isGuest()) {
            return Promise.resolve({}); // guests cannot send receipts so don't bother.
        }
@@ -4965,10 +5044,19 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            $eventId: event.getId()!,
        });

-        if (!unthreaded) {
-            const isThread = !!event.threadRootId;
+        if (!unthreaded && this.supportsThreads()) {
+            // XXX: the spec currently says a threaded read receipt can be sent for the root of a thread,
+            // but in practice this isn't possible and the spec needs updating.
+            const isThread =
+                !!event.threadRootId &&
+                // A thread cannot be just a thread root and a thread root can only be read in the main timeline
+                !event.isThreadRoot &&
+                // Similarly non-thread relations upon the thread root (reactions, edits) should also be for the main timeline.
+                event.isRelation() &&
+                (event.isRelation(THREAD_RELATION_TYPE.name) || event.relationEventId !== event.threadRootId);
            body = {
                ...body,
+                // Only thread replies should define a specific thread. Thread roots can only be read in the main timeline.
                thread_id: isThread ? event.threadRootId : MAIN_ROOM_TIMELINE,
            };
        }
@@ -5092,6 +5180,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            undefined,
            {
                prefix: MediaPrefix.R0,
+                priority: "low",
            },
        );
        // TODO: Expire the URL preview cache sometimes
@@ -5112,7 +5201,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            $roomId: roomId,
            $userId: this.getUserId()!,
        });
-        const data: any = {
+        const data: QueryDict = {
            typing: isTyping,
        };
        if (isTyping) {
@@ -5304,7 +5393,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        }

        const populationResults: { [roomId: string]: Error } = {};
-        const promises: Promise<any>[] = [];
+        const promises: Promise<unknown>[] = [];

        const doLeave = (roomId: string): Promise<void> => {
            return this.leave(roomId)
@@ -5505,6 +5594,16 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return getHttpUriForMxc(this.baseUrl, mxcUrl, width, height, resizeMethod, allowDirectLinks);
    }

+    /**
+     * Specify the set_presence value to be used for subsequent calls to the Sync API.
+     * This has an advantage over calls to the PUT /presence API in that it
+     * doesn't clobber status_msg set by other devices.
+     * @param presence - the presence to specify to set_presence of sync calls
+     */
+    public async setSyncPresence(presence?: SetPresence): Promise<void> {
+        this.syncApi?.setPresence(presence);
+    }
+
    /**
     * @param opts - Options to apply
     * @returns Promise which resolves
@@ -5897,7 +5996,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            throw new Error("getLatestTimeline only supports room timelines");
        }

-        let event;
+        let event: IRoomEvent | undefined;
        if (timelineSet.threadListType !== null) {
            const res = await this.createThreadListMessagesRequest(
                timelineSet.room.roomId,
@@ -6356,7 +6455,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            "",
        );

-        let readPromise: Promise<any> = Promise.resolve<any>(undefined);
+        let readPromise: Promise<unknown> = Promise.resolve();
        if (opts.allowRead) {
            readPromise = this.sendStateEvent(
                roomId,
@@ -6561,7 +6660,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     */
    private async requestTokenFromEndpoint<T extends IRequestTokenResponse>(
        endpoint: string,
-        params: Record<string, any>,
+        params: QueryDict,
    ): Promise<T> {
        const postParams = Object.assign({}, params);

@@ -7646,7 +7745,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @param bindThreepids - Set key 'email' to true to bind any email
     *     threepid uses during registration in the identity server. Set 'msisdn' to
     *     true to bind msisdn.
-     * @returns Promise which resolves: TODO
+     * @returns Promise which resolves to a RegisterResponse object
     * @returns Rejects: with an error response.
     */
    public register(
@@ -7657,7 +7756,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        bindThreepids?: boolean | null | { email?: boolean; msisdn?: boolean },
        guestAccessToken?: string,
        inhibitLogin?: boolean,
-    ): Promise<IAuthData> {
+    ): Promise<RegisterResponse> {
        // backwards compat
        if (bindThreepids === true) {
            bindThreepids = { email: true };
@@ -7668,7 +7767,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            auth.session = sessionId;
        }

-        const params: IRegisterRequestParams = {
+        const params: RegisterRequest = {
            auth: auth,
            refresh_token: true, // always ask for a refresh token - does nothing if unsupported
        };
@@ -7724,8 +7823,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *                   `{ user_id, device_id, access_token, home_server }`
     * @returns Rejects: with an error response.
     */
-    public registerGuest({ body }: { body?: any } = {}): Promise<any> {
-        // TODO: Types
+    public registerGuest({ body }: { body?: RegisterRequest } = {}): Promise<RegisterResponse> {
        return this.registerRequest(body || {}, "guest");
    }

@@ -7735,7 +7833,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: to the /register response
     * @returns Rejects: with an error response.
     */
-    public registerRequest(data: IRegisterRequestParams, kind?: string): Promise<IAuthData> {
+    public registerRequest(data: RegisterRequest, kind?: string): Promise<RegisterResponse> {
        const params: { kind?: string } = {};
        if (kind) {
            params.kind = kind;
@@ -7788,23 +7886,15 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    }

    /**
-     * @returns Promise which resolves: TODO
+     * @returns Promise which resolves to a LoginResponse object
     * @returns Rejects: with an error response.
     */
-    public login(loginType: string, data: any): Promise<any> {
-        // TODO: Types
-        const loginData = {
-            type: loginType,
-        };
-
-        // merge data into loginData
-        Object.assign(loginData, data);
-
+    public login(loginType: LoginRequest["type"], data: Omit<LoginRequest, "type">): Promise<LoginResponse> {
        return this.http
-            .authedRequest<{
-                access_token?: string;
-                user_id?: string;
-            }>(Method.Post, "/login", undefined, loginData)
+            .authedRequest<LoginResponse>(Method.Post, "/login", undefined, {
+                ...data,
+                type: loginType,
+            })
            .then((response) => {
                if (response.access_token && response.user_id) {
                    this.http.opts.accessToken = response.access_token;
@@ -7817,11 +7907,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    }

    /**
-     * @returns Promise which resolves: TODO
+     * @returns Promise which resolves to a LoginResponse object
     * @returns Rejects: with an error response.
     */
-    public loginWithPassword(user: string, password: string): Promise<any> {
-        // TODO: Types
+    public loginWithPassword(user: string, password: string): Promise<LoginResponse> {
        return this.login("m.login.password", {
            user: user,
            password: password,
@@ -7830,11 +7919,11 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    /**
     * @param relayState - URL Callback after SAML2 Authentication
-     * @returns Promise which resolves: TODO
+     * @returns Promise which resolves to a LoginResponse object
     * @returns Rejects: with an error response.
+     * @deprecated this isn't in the Matrix spec anymore
     */
-    public loginWithSAML2(relayState: string): Promise<any> {
-        // TODO: Types
+    public loginWithSAML2(relayState: string): Promise<LoginResponse> {
        return this.login("m.login.saml2", {
            relay_state: relayState,
        });
@@ -7874,11 +7963,10 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa

    /**
     * @param token - Login token previously received from homeserver
-     * @returns Promise which resolves: TODO
+     * @returns Promise which resolves to a LoginResponse object
     * @returns Rejects: with an error response.
     */
-    public loginWithToken(token: string): Promise<any> {
-        // TODO: Types
+    public loginWithToken(token: string): Promise<LoginResponse> {
        return this.login("m.login.token", {
            token: token,
        });
@@ -7922,8 +8010,11 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * to false.
     * @returns Promise which resolves: On success, the empty object
     */
-    public deactivateAccount(auth?: any, erase?: boolean): Promise<{}> {
-        const body: any = {};
+    public deactivateAccount(
+        auth?: AuthDict,
+        erase?: boolean,
+    ): Promise<{ id_server_unbind_result: IdServerUnbindResult }> {
+        const body: Body = {};
        if (auth) {
            body.auth = auth;
        }
@@ -7943,7 +8034,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: On success, the token response
     * or UIA auth data.
     */
-    public async requestLoginToken(auth?: IAuthDict): Promise<UIAResponse<LoginTokenPostResponse>> {
+    public async requestLoginToken(auth?: AuthDict): Promise<UIAResponse<LoginTokenPostResponse>> {
        // use capabilities to determine which revision of the MSC is being used
        const capabilities = await this.getCapabilities();
        // use r1 endpoint if capability is exposed otherwise use old r0 endpoint
@@ -8161,7 +8252,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
    public sendStateEvent(
        roomId: string,
        eventType: string,
-        content: any,
+        content: IContent,
        stateKey = "",
        opts: IRequestOpts = {},
    ): Promise<ISendEventResponse> {
@@ -8379,13 +8470,13 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *                 it invisible.
     * @returns Promise which resolves: result object
     * @returns Rejects: with an error response.
+     * @deprecated missing from the spec
     */
    public setRoomDirectoryVisibilityAppService(
        networkId: string,
        roomId: string,
        visibility: "public" | "private",
    ): Promise<any> {
-        // TODO: Types
        const path = utils.encodeUri("/directory/list/appservice/$networkId/$roomId", {
            $networkId: networkId,
            $roomId: roomId,
@@ -8401,7 +8492,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: an array of results.
     */
    public searchUserDirectory({ term, limit }: { term: string; limit?: number }): Promise<IUserDirectoryResponse> {
-        const body: any = {
+        const body: Body = {
            search_term: term,
        };

@@ -8479,14 +8570,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * Add a 3PID to your homeserver account and optionally bind it to an identity
     * server as well. An identity server is required as part of the `creds` object.
     *
-     * This API is deprecated, and you should instead use `addThreePidOnly`
-     * for homeservers that support it.
+     * @deprecated this API is deprecated, and you should instead use `addThreePidOnly` for homeservers that support it.
     *
     * @returns Promise which resolves: on success
     * @returns Rejects: with an error response.
     */
-    public addThreePid(creds: any, bind: boolean): Promise<any> {
-        // TODO: Types
+    public addThreePid(creds: IAddThreePidBody, bind: boolean): Promise<{ submit_url?: string }> {
        const path = "/account/3pid";
        const data = {
            threePidCreds: creds,
@@ -8583,7 +8672,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: to an empty object `{}`
     * @returns Rejects: with an error response.
     */
-    public setPassword(authDict: IAuthDict, newPassword: string, logoutDevices?: boolean): Promise<{}> {
+    public setPassword(authDict: AuthDict, newPassword: string, logoutDevices?: boolean): Promise<{}> {
        const path = "/account/password";
        const data = {
            auth: authDict,
@@ -8641,12 +8730,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: result object
     * @returns Rejects: with an error response.
     */
-    public deleteDevice(deviceId: string, auth?: IAuthDict): Promise<IAuthData | {}> {
+    public deleteDevice(deviceId: string, auth?: AuthDict): Promise<{}> {
        const path = utils.encodeUri("/devices/$device_id", {
            $device_id: deviceId,
        });

-        const body: any = {};
+        const body: Body = {};

        if (auth) {
            body.auth = auth;
@@ -8663,8 +8752,8 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: result object
     * @returns Rejects: with an error response.
     */
-    public deleteMultipleDevices(devices: string[], auth?: IAuthDict): Promise<IAuthData | {}> {
-        const body: any = { devices };
+    public deleteMultipleDevices(devices: string[], auth?: AuthDict): Promise<{}> {
+        const body: Body = { devices };

        if (auth) {
            body.auth = auth;
@@ -8841,7 +8930,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        { body, next_batch: nextBatch }: { body: ISearchRequestBody; next_batch?: string },
        abortSignal?: AbortSignal,
    ): Promise<ISearchResponse> {
-        const queryParams: any = {};
+        const queryParams: QueryDict = {};
        if (nextBatch) {
            queryParams.next_batch = nextBatch;
        }
@@ -8948,7 +9037,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        return this.http.authedRequest(Method.Get, "/keys/changes", qps);
    }

-    public uploadDeviceSigningKeys(auth?: IAuthDict, keys?: CrossSigningKeys): Promise<{}> {
+    public uploadDeviceSigningKeys(auth?: AuthDict, keys?: CrossSigningKeys): Promise<{}> {
        // API returns empty object
        const data = Object.assign({}, keys);
        if (auth) Object.assign(data, { auth });
@@ -9096,6 +9185,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @param msisdnToken - The MSISDN token, as enetered by the user.
     * @param identityAccessToken - The `access_token` field of the Identity
     * Server `/account/register` response (see {@link registerWithIdentityServer}).
+     * Some legacy identity servers had no authentication here.
     *
     * @returns Promise which resolves: Object, containing success boolean.
     * @returns Rejects: with an error response.
@@ -9105,7 +9195,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        sid: string,
        clientSecret: string,
        msisdnToken: string,
-        identityAccessToken: string,
+        identityAccessToken: string | null,
    ): Promise<{ success: boolean }> {
        const params = {
            sid: sid,
@@ -9118,7 +9208,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
            "/validate/msisdn/submitToken",
            params,
            IdentityPrefix.V2,
-            identityAccessToken,
+            identityAccessToken ?? undefined,
        );
    }

@@ -9160,8 +9250,17 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @param identityAccessToken - The access token for the identity server.
     * @returns The hashing information for the identity server.
     */
-    public getIdentityHashDetails(identityAccessToken: string): Promise<any> {
-        // TODO: Types
+    public getIdentityHashDetails(identityAccessToken: string): Promise<{
+        /**
+         * The algorithms the server supports. Must contain at least sha256.
+         */
+        algorithms: string[];
+        /**
+         * The pepper the client MUST use in hashing identifiers,
+         * and MUST supply to the /lookup endpoint when performing lookups.
+         */
+        lookup_pepper: string;
+    }> {
        return this.http.idServerRequest(
            Method.Get,
            "/hash_details",
@@ -9269,8 +9368,18 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *                                 exists
     * @returns Rejects: with an error response.
     */
-    public async lookupThreePid(medium: string, address: string, identityAccessToken: string): Promise<any> {
-        // TODO: Types
+    public async lookupThreePid(
+        medium: string,
+        address: string,
+        identityAccessToken: string,
+    ): Promise<
+        | {
+              address: string;
+              medium: string;
+              mxid: string;
+          }
+        | {}
+    > {
        // Note: we're using the V2 API by calling this function, but our
        // function contract requires a V1 response. We therefore have to
        // convert it manually.
@@ -9306,8 +9415,12 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: Lookup results from IS.
     * @returns Rejects: with an error response.
     */
-    public async bulkLookupThreePids(query: [string, string][], identityAccessToken: string): Promise<any> {
-        // TODO: Types
+    public async bulkLookupThreePids(
+        query: [string, string][],
+        identityAccessToken: string,
+    ): Promise<{
+        threepids: [medium: string, address: string, mxid: string][];
+    }> {
        // Note: we're using the V2 API by calling this function, but our
        // function contract requires a V1 response. We therefore have to
        // convert it manually.
@@ -9345,8 +9458,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @returns Promise which resolves: an object with account info.
     * @returns Rejects: with an error response.
     */
-    public getIdentityAccount(identityAccessToken: string): Promise<any> {
-        // TODO: Types
+    public getIdentityAccount(identityAccessToken: string): Promise<{ user_id: string }> {
        return this.http.idServerRequest(Method.Get, "/account", undefined, IdentityPrefix.V2, identityAccessToken);
    }

@@ -9438,8 +9550,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     *                        response to getThirdpartyProtocols()
     * @returns Promise which resolves to the result object
     */
-    public getThirdpartyUser(protocol: string, params: any): Promise<IThirdPartyUser[]> {
-        // TODO: Types
+    public getThirdpartyUser(protocol: string, params?: QueryDict): Promise<IThirdPartyUser[]> {
        const path = utils.encodeUri("/thirdparty/user/$protocol", {
            $protocol: protocol,
        });
@@ -9615,7 +9726,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
        proxyBaseUrl?: string,
        abortSignal?: AbortSignal,
    ): Promise<MSC3575SlidingSyncResponse> {
-        const qps: Record<string, any> = {};
+        const qps: QueryDict = {};
        if (req.pos) {
            qps.pos = req.pos;
            delete req.pos;
@@ -9689,6 +9800,7 @@ export class MatrixClient extends TypedEventEmitter<EmittedEvents, ClientEventHa
     * @param toStartOfTimeline - the direction
     */
    public processThreadRoots(room: Room, threadedEvents: MatrixEvent[], toStartOfTimeline: boolean): void {
+        if (!this.supportsThreads()) return;
        room.processThreadRoots(threadedEvents, toStartOfTimeline);
    }

@@ -9779,19 +9891,8 @@ export function fixNotificationCountOnDecryption(cli: MatrixClient, event: Matri
    const room = cli.getRoom(event.getRoomId());
    if (!room || !ourUserId || !eventId) return;

-    const oldActions = event.getPushActions();
-    const actions = cli.getPushActionsForEvent(event, true);
-
    const isThreadEvent = !!event.threadRootId && !event.isThreadRoot;

-    const currentHighlightCount = room.getUnreadCountForEventContext(NotificationCountType.Highlight, event);
-
-    // Ensure the unread counts are kept up to date if the event is encrypted
-    // We also want to make sure that the notification count goes up if we already
-    // have encrypted events to avoid other code from resetting 'highlight' to zero.
-    const oldHighlight = !!oldActions?.tweaks?.highlight;
-    const newHighlight = !!actions?.tweaks?.highlight;
-
    let hasReadEvent;
    if (isThreadEvent) {
        const thread = room.getThread(event.threadRootId);
@@ -9813,13 +9914,17 @@ export function fixNotificationCountOnDecryption(cli: MatrixClient, event: Matri
        return;
    }

-    if (oldHighlight !== newHighlight || currentHighlightCount > 0) {
+    const actions = cli.getPushActionsForEvent(event, true);
+
+    // Ensure the unread counts are kept up to date if the event is encrypted
+    // We also want to make sure that the notification count goes up if we already
+    // have encrypted events to avoid other code from resetting 'highlight' to zero.
+    const newHighlight = !!actions?.tweaks?.highlight;
+
+    if (newHighlight) {
        // TODO: Handle mentions received while the client is offline
        // See also https://github.com/vector-im/element-web/issues/9069
-        let newCount = currentHighlightCount;
-        if (newHighlight && !oldHighlight) newCount++;
-        if (!newHighlight && oldHighlight) newCount--;
-
+        const newCount = room.getUnreadCountForEventContext(NotificationCountType.Highlight, event) + 1;
        if (isThreadEvent) {
            room.setThreadUnreadNotificationCount(event.threadRootId, NotificationCountType.Highlight, newCount);
        } else {
@@ -9827,23 +9932,18 @@ export function fixNotificationCountOnDecryption(cli: MatrixClient, event: Matri
        }
    }

-    // Total count is used to typically increment a room notification counter, but not loudly highlight it.
-    const currentTotalCount = room.getUnreadCountForEventContext(NotificationCountType.Total, event);
-
    // `notify` is used in practice for incrementing the total count
    const newNotify = !!actions?.notify;

    // The room total count is NEVER incremented by the server for encrypted rooms. We basically ignore
    // the server here as it's always going to tell us to increment for encrypted events.
    if (newNotify) {
+        // Total count is used to typically increment a room notification counter, but not loudly highlight it.
+        const newCount = room.getUnreadCountForEventContext(NotificationCountType.Total, event) + 1;
        if (isThreadEvent) {
-            room.setThreadUnreadNotificationCount(
-                event.threadRootId,
-                NotificationCountType.Total,
-                currentTotalCount + 1,
-            );
+            room.setThreadUnreadNotificationCount(event.threadRootId, NotificationCountType.Total, newCount);
        } else {
-            room.setUnreadNotificationCount(NotificationCountType.Total, currentTotalCount + 1);
+            room.setUnreadNotificationCount(NotificationCountType.Total, newCount);
        }
    }
 }
@@ -24,6 +24,8 @@ import { IEventDecryptionResult } from "../@types/crypto";

 /**
 * Common interface for the crypto implementations
+ *
+ * @internal
 */
 export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
    /**
@@ -88,9 +90,21 @@ export interface CryptoBackend extends SyncCryptoCallbacks, CryptoApi {
     * @returns the cross signing information for the user.
     */
    getStoredCrossSigningForUser(userId: string): CrossSigningInfo | null;
+
+    /**
+     * Check the cross signing trust of the current user
+     *
+     * @param opts - Options object.
+     *
+     * @deprecated Unneeded for the new crypto
+     */
+    checkOwnCrossSigningTrust(opts?: CheckOwnCrossSigningTrustOpts): Promise<void>;
 }

-/** The methods which crypto implementations should expose to the Sync api */
+/** The methods which crypto implementations should expose to the Sync api
+ *
+ * @internal
+ */
 export interface SyncCryptoCallbacks {
    /**
     * Called by the /sync loop whenever there are incoming to-device messages.
@@ -146,6 +160,9 @@ export interface SyncCryptoCallbacks {
    onSyncCompleted(syncState: OnSyncCompletedData): void;
 }

+/**
+ * @internal
+ */
 export interface OnSyncCompletedData {
    /**
     * The 'next_batch' result from /sync, which will become the 'since' token for the next call to /sync.
@@ -157,3 +174,10 @@ export interface OnSyncCompletedData {
     */
    catchingUp?: boolean;
 }
+
+/**
+ * Options object for {@link CryptoBackend#checkOwnCrossSigningTrust}.
+ */
+export interface CheckOwnCrossSigningTrustOpts {
+    allowPrivateKeyRequests?: boolean;
+}
@@ -20,7 +20,8 @@ import { DeviceMap } from "./models/device";
 import { UIAuthCallback } from "./interactive-auth";
 import { AddSecretStorageKeyOpts, SecretStorageCallbacks, SecretStorageKeyDescription } from "./secret-storage";
 import { VerificationRequest } from "./crypto-api/verification";
-import { KeyBackupInfo } from "./crypto-api/keybackup";
+import { BackupTrustInfo, KeyBackupInfo } from "./crypto-api/keybackup";
+import { ISignatures } from "./@types/signed";

 /**
 * Public interface to the cryptography parts of the js-sdk
@@ -136,6 +137,22 @@ export interface CryptoApi {
     */
    getDeviceVerificationStatus(userId: string, deviceId: string): Promise<DeviceVerificationStatus | null>;

+    /**
+     * Mark the given device as locally verified.
+     *
+     * Marking a devices as locally verified has much the same effect as completing the verification dance, or receiving
+     * a cross-signing signature for it.
+     *
+     * @param userId - owner of the device
+     * @param deviceId - unique identifier for the device.
+     * @param verified - whether to mark the device as verified. Defaults to 'true'.
+     *
+     * @throws an error if the device is unknown, or has not published any encryption keys.
+     *
+     * @remarks Fires {@link CryptoEvent#DeviceVerificationChanged}
+     */
+    setDeviceVerified(userId: string, deviceId: string, verified?: boolean): Promise<void>;
+
    /**
     * Checks whether cross signing:
     * - is enabled on this account and trusted by this device
@@ -250,9 +267,20 @@ export interface CryptoApi {
     * @param roomId - the room to use for verification
     *
     * @returns the VerificationRequest that is in progress, if any
+     * @deprecated prefer `userId` parameter variant.
     */
    findVerificationRequestDMInProgress(roomId: string): VerificationRequest | undefined;

+    /**
+     * Finds a DM verification request that is already in progress for the given room and user.
+     *
+     * @param roomId - the room to use for verification.
+     * @param userId - search for a verification request for the given user.
+     *
+     * @returns the VerificationRequest that is in progress, if any.
+     */
+    findVerificationRequestDMInProgress(roomId: string, userId?: string): VerificationRequest | undefined;
+
    /**
     * Send a verification request to our other devices.
     *
@@ -284,6 +312,44 @@ export interface CryptoApi {
     * @returns a VerificationRequest when the request has been sent to the other party.
     */
    requestDeviceVerification(userId: string, deviceId: string): Promise<VerificationRequest>;
+
+    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+    //
+    // Secure key backup
+    //
+    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
+
+    /**
+     * Fetch the backup decryption key we have saved in our store.
+     *
+     * This can be used for gossiping the key to other devices.
+     *
+     * @returns the key, if any, or null
+     */
+    getSessionBackupPrivateKey(): Promise<Uint8Array | null>;
+
+    /**
+     * Store the backup decryption key.
+     *
+     * This should be called if the client has received the key from another device via secret sharing (gossiping).
+     *
+     * @param key - the backup decryption key
+     */
+    storeSessionBackupPrivateKey(key: Uint8Array): Promise<void>;
+
+    /**
+     * Get the current status of key backup.
+     *
+     * @returns If automatic key backups are enabled, the `version` of the active backup. Otherwise, `null`.
+     */
+    getActiveSessionBackupVersion(): Promise<string | null>;
+
+    /**
+     * Determine if a key backup can be trusted.
+     *
+     * @param info - key backup info dict from {@link MatrixClient#getKeyBackupVersion}.
+     */
+    isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo>;
 }

 /**
@@ -479,6 +545,17 @@ export enum CrossSigningKey {
    UserSigning = "user_signing",
 }

+/**
+ * Information on one of the cross-signing keys.
+ * @see https://spec.matrix.org/v1.7/client-server-api/#post_matrixclientv3keysdevice_signingupload
+ */
+export interface CrossSigningKeyInfo {
+    keys: { [algorithm: string]: string };
+    signatures?: ISignatures;
+    usage: string[];
+    user_id: string;
+}
+
 /**
 * Recovery key created by {@link CryptoApi#createRecoveryKeyFromPassphrase}
 */
@@ -31,7 +31,10 @@ export interface Aes256AuthData {
 }

 /**
- * Extra info of a recovery key
+ * Information about a server-side key backup.
+ *
+ * Returned by [`GET /_matrix/client/v3/room_keys/version`](https://spec.matrix.org/v1.7/client-server-api/#get_matrixclientv3room_keysversion)
+ * and hence {@link MatrixClient#getKeyBackupVersion}.
 */
 export interface KeyBackupInfo {
    algorithm: string;
@@ -40,3 +43,20 @@ export interface KeyBackupInfo {
    etag?: string;
    version?: string; // number contained within
 }
+
+/**
+ * Information on whether a given server-side backup is trusted.
+ */
+export interface BackupTrustInfo {
+    /**
+     * Is this backup trusted?
+     *
+     * True if, and only if, there is a valid signature on the backup from a trusted device.
+     */
+    readonly trusted: boolean;
+
+    /**
+     * True if this backup matches the stored decryption key.
+     */
+    readonly matchesDecryptionKey: boolean;
+}
@@ -128,9 +128,35 @@ export interface VerificationRequest
     * @param targetDevice - details of where to send the request to.
     *
     * @returns The verifier which will do the actual verification.
+     *
+     * @deprecated Use {@link VerificationRequest#startVerification} instead.
     */
    beginKeyVerification(method: string, targetDevice?: { userId?: string; deviceId?: string }): Verifier;

+    /**
+     * Send an `m.key.verification.start` event to start verification via a particular method.
+     *
+     * This is normally used when starting a verification via emojis (ie, `method` is set to `m.sas.v1`).
+     *
+     * @param method - the name of the verification method to use.
+     *
+     * @returns The verifier which will do the actual verification.
+     */
+    startVerification(method: string): Promise<Verifier>;
+
+    /**
+     * Start a QR code verification by providing a scanned QR code for this verification flow.
+     *
+     * Validates the QR code, and if it is ok, sends an `m.key.verification.start` event with `method` set to
+     * `m.reciprocate.v1`, to tell the other side the scan was successful.
+     *
+     * See also {@link VerificationRequest#startVerification} which can be used to start other verification methods.
+     *
+     * @param qrCodeData - the decoded QR code.
+     * @returns A verifier; call `.verify()` on it to wait for the other side to complete the verification flow.
+     */
+    scanQRCode(qrCodeData: Uint8Array): Promise<Verifier>;
+
    /**
     * The verifier which is doing the actual verification, once the method has been established.
     * Only defined when the `phase` is Started.
@@ -141,9 +167,19 @@ export interface VerificationRequest
     * Get the data for a QR code allowing the other device to verify this one, if it supports it.
     *
     * Only set after a .ready if the other party can scan a QR code, otherwise undefined.
+     *
+     * @deprecated Not supported in Rust Crypto. Use {@link VerificationRequest#generateQRCode} instead.
     */
    getQRCodeBytes(): Buffer | undefined;

+    /**
+     * Generate the data for a QR code allowing the other device to verify this one, if it supports it.
+     *
+     * Only returns data once `phase` is {@link VerificationPhase.Ready} and the other party can scan a QR code;
+     * otherwise returns `undefined`.
+     */
+    generateQRCode(): Promise<Buffer | undefined>;
+
    /**
     * If this request has been cancelled, the cancellation code (e.g `m.user`) which is responsible for cancelling
     * this verification.
@@ -274,7 +310,7 @@ export enum VerifierEvent {
    ShowSas = "show_sas",

    /**
-     * QR code data should be displayed to the user.
+     * The user should confirm if the other side has scanned our QR code.
     *
     * The payload is the {@link ShowQrCodeCallbacks} object.
     */
@@ -289,7 +325,7 @@ export type VerifierEventHandlerMap = {
 };

 /**
- * Callbacks for user actions while a QR code is displayed.
+ * Callbacks for user actions to confirm that the other side has scanned our QR code.
 *
 * This is exposed as the payload of a `VerifierEvent.ShowReciprocateQr` event, or can be retrieved directly from the
 * verifier as `reciprocateQREvent`.
@@ -18,8 +18,7 @@ limitations under the License.
 * Cross signing methods
 */

-import { PkSigning } from "@matrix-org/olm";
-
+import type { PkSigning } from "@matrix-org/olm";
 import { decodeBase64, encodeBase64, IObject, pkSign, pkVerify } from "./olmlib";
 import { logger } from "../logger";
 import { IndexedDBCryptoStore } from "../crypto/store/indexeddb-crypto-store";
@@ -245,7 +244,7 @@ export class CrossSigningInfo {
     * @returns A map from key type (string) to private key (Uint8Array)
     */
    public async getCrossSigningKeysFromCache(): Promise<Map<string, Uint8Array>> {
-        const keys = new Map();
+        const keys = new Map<string, Uint8Array>();
        const cacheCallbacks = this.cacheCallbacks;
        if (!cacheCallbacks) return keys;
        for (const type of ["master", "self_signing", "user_signing"]) {
@@ -294,8 +293,8 @@ export class CrossSigningInfo {

        const privateKeys: Record<string, Uint8Array> = {};
        const keys: Record<string, ICrossSigningKey> = {};
-        let masterSigning;
-        let masterPub;
+        let masterSigning: PkSigning | undefined;
+        let masterPub: string | undefined;

        try {
            if (level & CrossSigningLevel.MASTER) {
@@ -188,7 +188,7 @@ export class EncryptionSetupOperation {
            // We must only call `uploadDeviceSigningKeys` from inside this auth
            // helper to ensure we properly handle auth errors.
            await this.crossSigningKeys.authUpload?.((authDict) => {
-                return baseApis.uploadDeviceSigningKeys(authDict, keys as CrossSigningKeys);
+                return baseApis.uploadDeviceSigningKeys(authDict ?? undefined, keys as CrossSigningKeys);
            });

            // pass the new keys to the main instance of our own CrossSigningInfo.
@@ -1119,7 +1119,7 @@ export class OlmDevice {
                                }
                            }

-                            logger.info(
+                            logger.debug(
                                `Storing megolm session ${senderKey}|${sessionId} with first index ` +
                                    session.first_known_index(),
                            );
@@ -194,9 +194,10 @@ class OlmDecryption extends DecryptionAlgorithm {

        // check that the device that encrypted the event belongs to the user that the event claims it's from.
        //
-        // To do this, we need to make sure that our device list is up-to-date. If the device is unknown, we can only
-        // assume that the device logged out and accept it anyway. Some event handlers, such as secret sharing, may be
-        // more strict and reject events that come from unknown devices.
+        // If the device is unknown then we check that we don't have any pending key-query requests for the sender. If
+        // after that the device is still unknown, then we can only assume that the device logged out and accept it
+        // anyway. Some event handlers, such as secret sharing, may be more strict and reject events that come from
+        // unknown devices.
        //
        // This is a defence against the following scenario:
        //
@@ -204,14 +205,26 @@ class OlmDecryption extends DecryptionAlgorithm {
        //   * Mallory gets control of Alice's server, and sends a megolm session to Alice using her (Mallory's)
        //     senderkey, but claiming to be from Bob.
        //   * Mallory sends more events using that session, claiming to be from Bob.
-        //   * Alice sees that the senderkey is verified (since she verified Mallory) so marks events those
-        //     events as verified even though the sender is forged.
+        //   * Alice sees that the senderkey is verified (since she verified Mallory) so marks events those events as
+        //     verified even though the sender is forged.
        //
        // In practice, it's not clear that the js-sdk would behave that way, so this may be only a defence in depth.

-        await this.crypto.deviceList.downloadKeys([event.getSender()!], false);
-        const senderKeyUser = this.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);
-        if (senderKeyUser !== event.getSender() && senderKeyUser != undefined) {
+        let senderKeyUser = this.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);
+        if (senderKeyUser === undefined || senderKeyUser === null) {
+            // Wait for any pending key query fetches for the user to complete before trying the lookup again.
+            try {
+                await this.crypto.deviceList.downloadKeys([event.getSender()!], false);
+            } catch (e) {
+                throw new DecryptionError("OLM_BAD_SENDER_CHECK_FAILED", "Could not verify sender identity", {
+                    sender: deviceKey,
+                    err: e as Error,
+                });
+            }
+
+            senderKeyUser = this.crypto.deviceList.getUserByIdentityKey(olmlib.OLM_ALGORITHM, deviceKey);
+        }
+        if (senderKeyUser !== event.getSender() && senderKeyUser !== undefined && senderKeyUser !== null) {
            throw new DecryptionError("OLM_BAD_SENDER", "Message claimed to be from " + event.getSender(), {
                real_sender: senderKeyUser,
            });
@@ -40,6 +40,7 @@ import { UnstableValue } from "../NamespacedValue";
 import { CryptoEvent } from "./index";
 import { crypto } from "./crypto";
 import { HTTPError, MatrixError } from "../http-api";
+import { BackupTrustInfo } from "../crypto-api/keybackup";

 const KEY_BACKUP_KEYS_PER_REQUEST = 200;
 const KEY_BACKUP_CHECK_RATE_LIMIT = 5000; // ms
@@ -54,6 +55,7 @@ type SigInfo = {
    deviceTrust?: DeviceTrustLevel;
 };

+/** @deprecated Prefer {@link BackupTrustInfo} */
 export type TrustInfo = {
    usable: boolean; // is the backup trusted, true iff there is a sig that is valid & from a trusted device
    sigs: SigInfo[];
@@ -118,12 +120,21 @@ export class BackupManager {
    public checkedForBackup: boolean; // Have we checked the server for a backup we can use?
    private sendingBackups: boolean; // Are we currently sending backups?
    private sessionLastCheckAttemptedTime: Record<string, number> = {}; // When did we last try to check the server for a given session id?
+    // The backup manager will schedule backup of keys when active (`scheduleKeyBackupSend`), this allows cancel when client is stopped
+    private clientRunning = true;

    public constructor(private readonly baseApis: MatrixClient, public readonly getKey: GetKey) {
        this.checkedForBackup = false;
        this.sendingBackups = false;
    }

+    /**
+     * Stop the backup manager from backing up keys and allow a clean shutdown.
+     */
+    public stop(): void {
+        this.clientRunning = false;
+    }
+
    public get version(): string | undefined {
        return this.backupInfo && this.backupInfo.version;
    }
@@ -439,6 +450,10 @@ export class BackupManager {
            // the same time when a new key is sent
            const delay = Math.random() * maxDelay;
            await sleep(delay);
+            if (!this.clientRunning) {
+                logger.debug("Key backup send aborted, client stopped");
+                return;
+            }
            let numFailures = 0; // number of consecutive failures
            for (;;) {
                if (!this.algorithm) {
@@ -473,6 +488,11 @@ export class BackupManager {
                    // exponential backoff if we have failures
                    await sleep(1000 * Math.pow(2, Math.min(numFailures - 1, 4)));
                }
+
+                if (!this.clientRunning) {
+                    logger.debug("Key backup send loop aborted, client stopped");
+                    return;
+                }
            }
        } finally {
            this.sendingBackups = false;
@@ -811,3 +831,15 @@ export const algorithmsByName: Record<string, BackupAlgorithmClass> = {
 };

 export const DefaultAlgorithm: BackupAlgorithmClass = Curve25519;
+
+/**
+ * Map a legacy {@link TrustInfo} into a new-style {@link BackupTrustInfo}.
+ *
+ * @param trustInfo - trustInfo to convert
+ */
+export function backupTrustInfoFromLegacyTrustInfo(trustInfo: TrustInfo): BackupTrustInfo {
+    return {
+        trusted: trustInfo.usable,
+        matchesDecryptionKey: trustInfo.trusted_locally ?? false,
+    };
+}
@@ -28,6 +28,8 @@ export interface IDevice {

 /**
 * Information about a user's device
+ *
+ * Superceded by {@link Device}.
 */
 export class DeviceInfo {
    /**
@@ -48,9 +48,9 @@ import { InRoomChannel, InRoomRequests } from "./verification/request/InRoomChan
 import { Request, ToDeviceChannel, ToDeviceRequests } from "./verification/request/ToDeviceChannel";
 import { IllegalMethod } from "./verification/IllegalMethod";
 import { KeySignatureUploadError } from "../errors";
-import { calculateKeyCheck, decryptAES, encryptAES } from "./aes";
+import { calculateKeyCheck, decryptAES, encryptAES, IEncryptedPayload } from "./aes";
 import { DehydrationManager } from "./dehydration";
-import { BackupManager } from "./backup";
+import { BackupManager, backupTrustInfoFromLegacyTrustInfo } from "./backup";
 import { IStore } from "../store";
 import { Room, RoomEvent } from "../models/room";
 import { RoomMember, RoomMemberEvent } from "../models/room-member";
@@ -87,10 +87,13 @@ import {
 } from "../secret-storage";
 import { ISecretRequest } from "./SecretSharing";
 import {
+    BackupTrustInfo,
    BootstrapCrossSigningOpts,
    CrossSigningStatus,
    DeviceVerificationStatus,
    ImportRoomKeysOpts,
+    KeyBackupInfo,
+    VerificationRequest as CryptoApiVerificationRequest,
 } from "../crypto-api";
 import { Device, DeviceMap } from "../models/device";
 import { deviceInfoToDevice } from "./device-converter";
@@ -129,7 +132,12 @@ export function isCryptoAvailable(): boolean {
    return Boolean(global.Olm);
 }

-const MIN_FORCE_SESSION_INTERVAL_MS = 60 * 60 * 1000;
+// minimum time between attempting to unwedge an Olm session, if we succeeded
+// in creating a new session
+const MIN_FORCE_SESSION_INTERVAL_MS = 60 * 60 * 1000; // 1 hour
+// minimum time between attempting to unwedge an Olm session, if we failed
+// to create a new session
+const FORCE_SESSION_RETRY_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes

 interface IInitOpts {
    exportedOlmDevice?: IExportedDevice;
@@ -218,7 +226,16 @@ export enum CryptoEvent {
    KeyBackupFailed = "crypto.keyBackupFailed",
    KeyBackupSessionsRemaining = "crypto.keyBackupSessionsRemaining",
    KeySignatureUploadFailure = "crypto.keySignatureUploadFailure",
+    /** @deprecated Use `VerificationRequestReceived`. */
    VerificationRequest = "crypto.verification.request",
+
+    /**
+     * Fires when a key verification request is received.
+     *
+     * The payload is a {@link Crypto.VerificationRequest}.
+     */
+    VerificationRequestReceived = "crypto.verificationRequestReceived",
+
    Warning = "crypto.warning",
    WillUpdateDevices = "crypto.willUpdateDevices",
    DevicesUpdated = "crypto.devicesUpdated",
@@ -280,8 +297,16 @@ export type CryptoEventHandlerMap = {
    ) => void;
    /**
     * Fires when a key verification is requested.
+     *
+     * Deprecated: use `CryptoEvent.VerificationRequestReceived`.
     */
    [CryptoEvent.VerificationRequest]: (request: VerificationRequest<any>) => void;
+
+    /**
+     * Fires when a key verification request is received.
+     */
+    [CryptoEvent.VerificationRequestReceived]: (request: CryptoApiVerificationRequest) => void;
+
    /**
     * Fires when the app may wish to warn the user about something related
     * the end-to-end crypto.
@@ -372,7 +397,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
    // to avoid loading room members as long as possible.
    private roomDeviceTrackingState: { [roomId: string]: Promise<void> } = {};

-    // The timestamp of the last time we forced establishment
+    // The timestamp of the minimum time at which we will retry forcing establishment
    // of a new session for each device, in milliseconds.
    // {
    //     userId: {
@@ -380,7 +405,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
    //     },
    // }
    // Map: user Id → device Id → timestamp
-    private lastNewSessionForced: MapWithDefault<string, MapWithDefault<string, number>> = new MapWithDefault(
+    private forceNewSessionRetryTime: MapWithDefault<string, MapWithDefault<string, number>> = new MapWithDefault(
        () => new MapWithDefault(() => 0),
    );

@@ -1219,21 +1244,22 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
     * @returns the key, if any, or null
     */
    public async getSessionBackupPrivateKey(): Promise<Uint8Array | null> {
-        let key = await new Promise<any>((resolve) => {
-            // TODO types
+        const encodedKey = await new Promise<Uint8Array | IEncryptedPayload | string | null>((resolve) => {
            this.cryptoStore.doTxn("readonly", [IndexedDBCryptoStore.STORE_ACCOUNT], (txn) => {
                this.cryptoStore.getSecretStorePrivateKey(txn, resolve, "m.megolm_backup.v1");
            });
        });

+        let key: Uint8Array | null = null;
+
        // make sure we have a Uint8Array, rather than a string
-        if (key && typeof key === "string") {
-            key = new Uint8Array(olmlib.decodeBase64(fixBackupKey(key) || key));
+        if (typeof encodedKey === "string") {
+            key = new Uint8Array(olmlib.decodeBase64(fixBackupKey(encodedKey) || encodedKey));
            await this.storeSessionBackupPrivateKey(key);
        }
-        if (key && key.ciphertext) {
+        if (encodedKey && typeof encodedKey === "object" && "ciphertext" in encodedKey) {
            const pickleKey = Buffer.from(this.olmDevice.pickleKey);
-            const decrypted = await decryptAES(key, pickleKey, "m.megolm_backup.v1");
+            const decrypted = await decryptAES(encodedKey, pickleKey, "m.megolm_backup.v1");
            key = olmlib.decodeBase64(decrypted);
        }
        return key;
@@ -1256,6 +1282,28 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        });
    }

+    /**
+     * Get the current status of key backup.
+     *
+     * Implementation of {@link CryptoApi.getActiveSessionBackupVersion}.
+     */
+    public async getActiveSessionBackupVersion(): Promise<string | null> {
+        if (this.backupManager.getKeyBackupEnabled()) {
+            return this.backupManager.version ?? null;
+        }
+        return null;
+    }
+
+    /**
+     * Determine if a key backup can be trusted.
+     *
+     * Implementation of {@link Crypto.CryptoApi.isKeyBackupTrusted}.
+     */
+    public async isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo> {
+        const trustInfo = await this.backupManager.isKeyBackupTrusted(info);
+        return backupTrustInfoFromLegacyTrustInfo(trustInfo);
+    }
+
    /**
     * Checks that a given cross-signing private key matches a given public key.
     * This can be used by the getCrossSigningKey callback to verify that the
@@ -1814,6 +1862,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        this.outgoingRoomKeyRequestManager.stop();
        this.deviceList.stop();
        this.dehydrationManager.stop();
+        this.backupManager.stop();
    }

    /**
@@ -2149,6 +2198,15 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        return this.deviceList.saveIfDirty(delay);
    }

+    /**
+     * Mark the given device as locally verified.
+     *
+     * Implementation of {@link CryptoApi#setDeviceVerified}.
+     */
+    public async setDeviceVerified(userId: string, deviceId: string, verified = true): Promise<void> {
+        await this.setDeviceVerification(userId, deviceId, verified);
+    }
+
    /**
     * Update the blocked/verified state of the given device
     *
@@ -2178,12 +2236,12 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        blocked: boolean | null = null,
        known: boolean | null = null,
        keys?: Record<string, string>,
-    ): Promise<DeviceInfo | CrossSigningInfo> {
+    ): Promise<DeviceInfo | CrossSigningInfo | ICrossSigningKey | undefined> {
        // Check if the 'device' is actually a cross signing key
        // The js-sdk's verification treats cross-signing keys as devices
        // and so uses this method to mark them verified.
        const xsk = this.deviceList.getStoredCrossSigningForUser(userId);
-        if (xsk && xsk.getId() === deviceId) {
+        if (xsk?.getId() === deviceId) {
            if (blocked !== null || known !== null) {
                throw new Error("Cannot set blocked or known for a cross-signing key");
            }
@@ -2233,7 +2291,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
                    // This will emit events when it comes back down the sync
                    // (we could do local echo to speed things up)
                }
-                return device as any; // TODO types
+                return device!;
            } else {
                return xsk;
            }
@@ -2322,8 +2380,8 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        return deviceObj;
    }

-    public findVerificationRequestDMInProgress(roomId: string): VerificationRequest | undefined {
-        return this.inRoomVerificationRequests.findRequestInProgress(roomId);
+    public findVerificationRequestDMInProgress(roomId: string, userId?: string): VerificationRequest | undefined {
+        return this.inRoomVerificationRequests.findRequestInProgress(roomId, userId);
    }

    public getVerificationRequestsToDeviceInProgress(userId: string): VerificationRequest[] {
@@ -3541,6 +3599,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
            !request.observeOnly;
        if (shouldEmit) {
            this.baseApis.emit(CryptoEvent.VerificationRequest, request);
+            this.baseApis.emit(CryptoEvent.VerificationRequestReceived, request);
        }
    }

@@ -3572,25 +3631,23 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
            return;
        }

-        // check when we last forced a new session with this device: if we've already done so
+        // check when we can force a new session with this device: if we've already done so
        // recently, don't do it again.
-        const lastNewSessionDevices = this.lastNewSessionForced.getOrCreate(sender);
-        const lastNewSessionForced = lastNewSessionDevices.getOrCreate(deviceKey);
-        if (lastNewSessionForced + MIN_FORCE_SESSION_INTERVAL_MS > Date.now()) {
+        const forceNewSessionRetryTimeDevices = this.forceNewSessionRetryTime.getOrCreate(sender);
+        const forceNewSessionRetryTime = forceNewSessionRetryTimeDevices.getOrCreate(deviceKey);
+        if (forceNewSessionRetryTime > Date.now()) {
            logger.debug(
-                "New session already forced with device " +
-                    sender +
-                    ":" +
-                    deviceKey +
-                    " at " +
-                    lastNewSessionForced +
-                    ": not forcing another",
+                `New session already forced with device ${sender}:${deviceKey}: ` +
+                    `not forcing another until at least ${new Date(forceNewSessionRetryTime).toUTCString()}`,
            );
            await this.olmDevice.recordSessionProblem(deviceKey, "wedged", true);
            retryDecryption();
            return;
        }

+        // make sure we don't retry to unwedge too soon even if we fail to create a new session
+        forceNewSessionRetryTimeDevices.set(deviceKey, Date.now() + FORCE_SESSION_RETRY_INTERVAL_MS);
+
        // establish a new olm session with this device since we're failing to decrypt messages
        // on a current session.
        // Note that an undecryptable message from another device could easily be spoofed -
@@ -3611,7 +3668,7 @@ export class Crypto extends TypedEventEmitter<CryptoEvent, CryptoEventHandlerMap
        const devicesByUser = new Map([[sender, [device]]]);
        await olmlib.ensureOlmSessionsForDevices(this.olmDevice, this.baseApis, devicesByUser, true);

-        lastNewSessionDevices.set(deviceKey, Date.now());
+        forceNewSessionRetryTimeDevices.set(deviceKey, Date.now() + MIN_FORCE_SESSION_INTERVAL_MS);

        // Now send a blank message on that session so the other side knows about it.
        // (The keyshare request is sent in the clear so that won't do)
@@ -18,6 +18,7 @@ limitations under the License.
 * QR code key verification.
 */

+import { crypto } from "../crypto";
 import { VerificationBase as Base } from "./Base";
 import { newKeyMismatchError, newUserCancelledError } from "./Error";
 import { decodeBase64, encodeUnpaddedBase64 } from "../olmlib";
@@ -200,7 +201,7 @@ export class QRCodeData {

    private static generateSharedSecret(): string {
        const secretBytes = new Uint8Array(11);
-        global.crypto.getRandomValues(secretBytes);
+        crypto.getRandomValues(secretBytes);
        return encodeUnpaddedBase64(secretBytes);
    }

@@ -52,17 +52,22 @@ const newMismatchedSASError = errorFactory("m.mismatched_sas", "Mismatched short

 const newMismatchedCommitmentError = errorFactory("m.mismatched_commitment", "Mismatched commitment");

+// This list was generated from the data in the Matrix specification [1] with the following command:
+//
+//    jq  -r '.[] |  "    [\"" + .emoji + "\", \"" + (.description|ascii_downcase) + "\"], // " + (.number|tostring)' sas-emoji.json
+//
+// [1]: https://github.com/matrix-org/matrix-spec/blob/main/data-definitions/sas-emoji.json
 const emojiMapping: EmojiMapping[] = [
-    ["🐶", "dog"], //  0
-    ["🐱", "cat"], //  1
-    ["🦁", "lion"], //  2
-    ["🐎", "horse"], //  3
-    ["🦄", "unicorn"], //  4
-    ["🐷", "pig"], //  5
-    ["🐘", "elephant"], //  6
-    ["🐰", "rabbit"], //  7
-    ["🐼", "panda"], //  8
-    ["🐓", "rooster"], //  9
+    ["🐶", "dog"], // 0
+    ["🐱", "cat"], // 1
+    ["🦁", "lion"], // 2
+    ["🐎", "horse"], // 3
+    ["🦄", "unicorn"], // 4
+    ["🐷", "pig"], // 5
+    ["🐘", "elephant"], // 6
+    ["🐰", "rabbit"], // 7
+    ["🐼", "panda"], // 8
+    ["🐓", "rooster"], // 9
    ["🐧", "penguin"], // 10
    ["🐢", "turtle"], // 11
    ["🐟", "fish"], // 12
@@ -83,7 +88,7 @@ const emojiMapping: EmojiMapping[] = [
    ["🍕", "pizza"], // 27
    ["🎂", "cake"], // 28
    ["❤️", "heart"], // 29
-    ["🙂", "smiley"], // 30
+    ["😀", "smiley"], // 30
    ["🤖", "robot"], // 31
    ["🎩", "hat"], // 32
    ["👓", "glasses"], // 33
@@ -113,7 +118,7 @@ const emojiMapping: EmojiMapping[] = [
    ["🎸", "guitar"], // 57
    ["🎺", "trumpet"], // 58
    ["🔔", "bell"], // 59
-    ["⚓️", "anchor"], // 60
+    ["⚓", "anchor"], // 60
    ["🎧", "headphones"], // 61
    ["📁", "folder"], // 62
    ["📌", "pin"], // 63
@@ -350,11 +350,11 @@ export class InRoomRequests implements IRequestsMap {
        }
    }

-    public findRequestInProgress(roomId: string): VerificationRequest | undefined {
+    public findRequestInProgress(roomId: string, userId?: string): VerificationRequest | undefined {
        const requestsByTxnId = this.requestsByRoomId.get(roomId);
        if (requestsByTxnId) {
            for (const request of requestsByTxnId.values()) {
-                if (request.pending) {
+                if (request.pending && (userId === undefined || request.requestingUserId === userId)) {
                    return request;
                }
            }
@@ -30,6 +30,7 @@ import {
    VerificationRequest as IVerificationRequest,
    VerificationRequestEvent,
    VerificationRequestEventHandlerMap,
+    Verifier,
 } from "../../../crypto-api/verification";

 // backwards-compatibility exports
@@ -267,7 +268,7 @@ export class VerificationRequest<C extends IVerificationChannel = IVerificationC

    /** Only set after a .ready if the other party can scan a QR code
     *
-     * @deprecated Prefer `getQRCodeBytes`.
+     * @deprecated Prefer `generateQRCode`.
     */
    public get qrCodeData(): QRCodeData | null {
        return this._qrCodeData;
@@ -277,11 +278,23 @@ export class VerificationRequest<C extends IVerificationChannel = IVerificationC
     * Get the data for a QR code allowing the other device to verify this one, if it supports it.
     *
     * Only set after a .ready if the other party can scan a QR code, otherwise undefined.
+     *
+     * @deprecated Prefer `generateQRCode`.
     */
    public getQRCodeBytes(): Buffer | undefined {
        return this._qrCodeData?.getBuffer();
    }

+    /**
+     * Generate the data for a QR code allowing the other device to verify this one, if it supports it.
+     *
+     * Only returns data once `phase` is `Ready` and the other party can scan a QR code;
+     * otherwise returns `undefined`.
+     */
+    public async generateQRCode(): Promise<Buffer | undefined> {
+        return this.getQRCodeBytes();
+    }
+
    /** Checks whether the other party supports a given verification method.
     *  This is useful when setting up the QR code UI, as it is somewhat asymmetrical:
     *  if the other party supports SCAN_QR, we should show a QR code in the UI, and vice versa.
@@ -458,6 +471,17 @@ export class VerificationRequest<C extends IVerificationChannel = IVerificationC
        return this._verifier!;
    }

+    public async startVerification(method: string): Promise<Verifier> {
+        const verifier = this.beginKeyVerification(method);
+        // kick off the verification in the background, but *don't* wait for to complete: we need to return the `Verifier`.
+        verifier.verify();
+        return verifier;
+    }
+
+    public scanQRCode(qrCodeData: Uint8Array): Promise<Verifier> {
+        throw new Error("QR code scanning not supported by legacy crypto");
+    }
+
    /**
     * sends the initial .request event.
     * @returns resolves when the event has been sent.
@@ -97,7 +97,7 @@ export interface ICapabilities {
 */
 export class RoomWidgetClient extends MatrixClient {
    private room?: Room;
-    private widgetApiReady = new Promise<void>((resolve) => this.widgetApi.once("ready", resolve));
+    private readonly widgetApiReady: Promise<void>;
    private lifecycle?: AbortController;
    private syncState: SyncState | null = null;

@@ -109,6 +109,8 @@ export class RoomWidgetClient extends MatrixClient {
    ) {
        super(opts);

+        this.widgetApiReady = new Promise<void>((resolve) => this.widgetApi.once("ready", resolve));
+
        // Request capabilities for the functionality this client needs to support
        if (
            capabilities.sendEvent?.length ||
@@ -63,6 +63,7 @@ const featureSupportResolver: Record<string, FeatureSupportCondition> = {
    },
    [Feature.IntentionalMentions]: {
        unstablePrefixes: ["org.matrix.msc3952_intentional_mentions"],
+        matrixVersion: "v1.7",
    },
 };

@@ -22,11 +22,10 @@ import { checkObjectHasKeys, encodeParams } from "../utils";
 import { TypedEventEmitter } from "../models/typed-event-emitter";
 import { Method } from "./method";
 import { ConnectionError, MatrixError } from "./errors";
-import { HttpApiEvent, HttpApiEventHandlerMap, IHttpOpts, IRequestOpts } from "./interface";
+import { HttpApiEvent, HttpApiEventHandlerMap, IHttpOpts, IRequestOpts, Body } from "./interface";
 import { anySignal, parseErrorResponse, timeoutSignal } from "./utils";
 import { QueryDict } from "../utils";
-
-type Body = Record<string, any> | BodyInit;
+import { logger } from "../logger";

 interface TypedResponse<T> extends Response {
    json(): Promise<T>;
@@ -223,8 +222,11 @@ export class FetchHttpApi<O extends IHttpOpts> {
        method: Method,
        url: URL | string,
        body?: Body,
-        opts: Pick<IRequestOpts, "headers" | "json" | "localTimeoutMs" | "keepAlive" | "abortSignal"> = {},
+        opts: Pick<IRequestOpts, "headers" | "json" | "localTimeoutMs" | "keepAlive" | "abortSignal" | "priority"> = {},
    ): Promise<ResponseType<T, O>> {
+        const urlForLogs = this.sanitizeUrlForLogs(url);
+        logger.debug(`FetchHttpApi: --> ${method} ${urlForLogs}`);
+
        const headers = Object.assign({}, opts.headers || {});
        const json = opts.json ?? true;
        // We can't use getPrototypeOf here as objects made in other contexts e.g. over postMessage won't have same ref
@@ -260,6 +262,7 @@ export class FetchHttpApi<O extends IHttpOpts> {
        const { signal, cleanup } = anySignal(signals);

        let res: Response;
+        const start = Date.now();
        try {
            res = await this.fetch(url, {
                signal,
@@ -273,8 +276,12 @@ export class FetchHttpApi<O extends IHttpOpts> {
                cache: "no-cache",
                credentials: "omit", // we send credentials via headers
                keepalive: keepAlive,
+                priority: opts.priority,
            });
+
+            logger.debug(`FetchHttpApi: <-- ${method} ${urlForLogs} [${Date.now() - start}ms ${res.status}]`);
        } catch (e) {
+            logger.debug(`FetchHttpApi: <-- ${method} ${urlForLogs} [${Date.now() - start}ms ${e}]`);
            if ((<Error>e).name === "AbortError") {
                throw e;
            }
@@ -293,6 +300,28 @@ export class FetchHttpApi<O extends IHttpOpts> {
        return res as ResponseType<T, O>;
    }

+    private sanitizeUrlForLogs(url: URL | string): string {
+        try {
+            let asUrl: URL;
+            if (typeof url === "string") {
+                asUrl = new URL(url);
+            } else {
+                asUrl = url;
+            }
+            // Remove the values of any URL params that could contain potential secrets
+            const sanitizedQs = new URLSearchParams();
+            for (const key of asUrl.searchParams.keys()) {
+                sanitizedQs.append(key, "xxx");
+            }
+            const sanitizedQsString = sanitizedQs.toString();
+            const sanitizedQsUrlPiece = sanitizedQsString ? `?${sanitizedQsString}` : "";
+
+            return asUrl.origin + asUrl.pathname + sanitizedQsUrlPiece;
+        } catch (error) {
+            // defensive coding for malformed url
+            return "??";
+        }
+    }
    /**
     * Form and return a homeserver request URL based on the given path params and prefix.
     * @param path - The HTTP path <b>after</b> the supplied prefix e.g. "/createRoom".
@@ -16,6 +16,8 @@ limitations under the License.

 import { MatrixError } from "./errors";

+export type Body = Record<string, any> | BodyInit;
+
 export interface IHttpOpts {
    fetchFn?: typeof global.fetch;

@@ -31,7 +33,7 @@ export interface IHttpOpts {
    localTimeoutMs?: number;
 }

-export interface IRequestOpts {
+export interface IRequestOpts extends Pick<RequestInit, "priority"> {
    /**
     * The alternative base url to use.
     * If not specified, uses this.opts.baseUrl
@@ -21,6 +21,7 @@ import { MatrixClient } from "./client";
 import { defer, IDeferred } from "./utils";
 import { MatrixError } from "./http-api";
 import { UIAResponse } from "./@types/uia";
+import { UserIdentifier } from "./@types/auth";

 const EMAIL_STAGE_TYPE = "m.login.email.identity";
 const MSISDN_STAGE_TYPE = "m.login.msisdn";
@@ -51,22 +52,25 @@ export interface IStageStatus {
 * @see https://spec.matrix.org/v1.6/client-server-api/#user-interactive-api-in-the-rest-api
 */
 export interface IAuthData {
-    // XXX: many of the fields here (`type`, `available_flows`, `required_stages`, etc) look like they
-    // shouldn't be here. They aren't in the spec and it's unclear what they are supposed to do. Be wary of using them.
+    /**
+     * This is a session identifier that the client must pass back to the home server,
+     * if one is provided, in subsequent attempts to authenticate in the same API call.
+     */
    session?: string;
-    type?: string;
+    /**
+     * A list of the stages the client has completed successfully
+     */
    completed?: string[];
+    /**
+     * A list of the login flows supported by the server for this API.
+     */
    flows?: UIAFlow[];
-    available_flows?: UIAFlow[];
-    stages?: string[];
-    required_stages?: AuthType[];
+    /**
+     * Contains any information that the client will need to know in order to use a given type of authentication.
+     * For each login type presented, that type may be present as a key in this dictionary.
+     * For example, the public part of an OAuth client ID could be given here.
+     */
    params?: Record<string, Record<string, any>>;
-    data?: Record<string, string>;
-    errcode?: string;
-    error?: string;
-    user_id?: string;
-    device_id?: string;
-    access_token?: string;
 }

 export enum AuthType {
@@ -85,30 +89,62 @@ export enum AuthType {
    UnstableRegistrationToken = "org.matrix.msc3231.login.registration_token",
 }

+/**
+ * https://spec.matrix.org/v1.7/client-server-api/#password-based
+ */
+type PasswordDict = {
+    type: AuthType.Password;
+    identifier: UserIdentifier;
+    password: string;
+    session: string;
+};
+
+/**
+ * https://spec.matrix.org/v1.7/client-server-api/#google-recaptcha
+ */
+type RecaptchaDict = {
+    type: AuthType.Recaptcha;
+    response: string;
+    session: string;
+};
+
+interface ThreepidCreds {
+    sid: string;
+    client_secret: string;
+    id_server: string;
+    id_access_token: string;
+}
+
+/**
+ * https://spec.matrix.org/v1.7/client-server-api/#email-based-identity--homeserver
+ */
+type EmailIdentityDict = {
+    type: AuthType.Email;
+    threepid_creds: ThreepidCreds;
+    /**
+     * @deprecated in favour of `threepid_creds` - kept for backwards compatibility
+     */
+    threepidCreds?: ThreepidCreds;
+    session: string;
+};
+
 /**
 * The parameters which are submitted as the `auth` dict in a UIA request
 *
 * @see https://spec.matrix.org/v1.6/client-server-api/#authentication-types
 */
-export interface IAuthDict {
-    // [key: string]: any;
-    type?: string;
-    session?: string;
-    // TODO: Remove `user` once servers support proper UIA
-    // See https://github.com/vector-im/element-web/issues/10312
-    user?: string;
-    identifier?: any;
-    password?: string;
-    response?: string;
-    // TODO: Remove `threepid_creds` once servers support proper UIA
-    // See https://github.com/vector-im/element-web/issues/10312
-    // See https://github.com/matrix-org/matrix-doc/issues/2220
-    // eslint-disable-next-line camelcase
-    threepid_creds?: any;
-    threepidCreds?: any;
-    // For m.login.registration_token type
-    token?: string;
-}
+export type AuthDict =
+    | PasswordDict
+    | RecaptchaDict
+    | EmailIdentityDict
+    | { type: Exclude<string, AuthType>; [key: string]: any }
+    | {};
+
+/**
+ * Backwards compatible export
+ * @deprecated in favour of AuthDict
+ */
+export type IAuthDict = AuthDict;

 export class NoAuthFlowFoundError extends Error {
    public name = "NoAuthFlowFoundError";
@@ -123,13 +159,14 @@ export class NoAuthFlowFoundError extends Error {
 * The type of an application callback to perform the user-interactive bit of UIA.
 *
 * It is called with a single parameter, `makeRequest`, which is a function which takes the UIA parameters and
- * makes the HTTP request.
+ * makes the HTTP request. The `authData` parameter in `makeRequest` can be set to null to omit the `auth` field
+ * from the UIA request.
 *
 * The generic parameter `T` is the type of the response of the endpoint, once it is eventually successful.
 */
-export type UIAuthCallback<T> = (makeRequest: (authData: IAuthDict) => Promise<UIAResponse<T>>) => Promise<T>;
+export type UIAuthCallback<T> = (makeRequest: (authData: IAuthDict | null) => Promise<UIAResponse<T>>) => Promise<T>;

-interface IOpts {
+interface IOpts<T> {
    /**
     * A matrix client to use for the auth process
     */
@@ -170,7 +207,7 @@ interface IOpts {
     * The busyChanged callback should be used instead of the background flag.
     * Should return a promise which resolves to the successful response or rejects with a MatrixError.
     */
-    doRequest(auth: IAuthDict | null, background: boolean): Promise<IAuthData>;
+    doRequest(auth: AuthDict | null, background: boolean): Promise<T>;
    /**
     * Called when the status of the UI auth changes,
     * ie. when the state of an auth stage changes of when the auth flow moves to a new stage.
@@ -215,21 +252,23 @@ interface IOpts {
 * submitAuthDict.
 *
 * @param opts - options object
+ * @typeParam T - the return type of the request when it is successful
 */
-export class InteractiveAuth {
+export class InteractiveAuth<T> {
    private readonly matrixClient: MatrixClient;
    private readonly inputs: IInputs;
    private readonly clientSecret: string;
-    private readonly requestCallback: IOpts["doRequest"];
-    private readonly busyChangedCallback?: IOpts["busyChanged"];
-    private readonly stateUpdatedCallback: IOpts["stateUpdated"];
-    private readonly requestEmailTokenCallback: IOpts["requestEmailToken"];
+    private readonly requestCallback: IOpts<T>["doRequest"];
+    private readonly busyChangedCallback?: IOpts<T>["busyChanged"];
+    private readonly stateUpdatedCallback: IOpts<T>["stateUpdated"];
+    private readonly requestEmailTokenCallback: IOpts<T>["requestEmailToken"];
    private readonly supportedStages?: Set<string>;

-    private data: IAuthData;
+    // The current latest data or error received from the server during the user interactive auth flow.
+    private data: IAuthData & MatrixError["data"];
    private emailSid?: string;
    private requestingEmailToken = false;
-    private attemptAuthDeferred: IDeferred<IAuthData> | null = null;
+    private attemptAuthDeferred: IDeferred<T> | null = null;
    private chosenFlow: UIAFlow | null = null;
    private currentStage: string | null = null;

@@ -239,9 +278,9 @@ export class InteractiveAuth {
    // the promise the will resolve/reject when it completes
    private submitPromise: Promise<void> | null = null;

-    public constructor(opts: IOpts) {
+    public constructor(opts: IOpts<T>) {
        this.matrixClient = opts.matrixClient;
-        this.data = opts.authData || {};
+        this.data = opts.authData || { flows: [] };
        this.requestCallback = opts.doRequest;
        this.busyChangedCallback = opts.busyChanged;
        // startAuthStage included for backwards compat
@@ -262,7 +301,7 @@ export class InteractiveAuth {
     * or rejects with the error on failure. Rejects with NoAuthFlowFoundError if
     *     no suitable authentication flow can be found
     */
-    public attemptAuth(): Promise<IAuthData> {
+    public async attemptAuth(): Promise<T> {
        // This promise will be quite long-lived and will resolve when the
        // request is authenticated and completes successfully.
        this.attemptAuthDeferred = defer();
@@ -270,10 +309,10 @@ export class InteractiveAuth {
        const promise = this.attemptAuthDeferred.promise;

        // if we have no flows, try a request to acquire the flows
-        if (!this.data?.flows) {
+        if (!(this.data as IAuthData)?.flows?.length) {
            this.busyChangedCallback?.(true);
            // use the existing sessionId, if one is present.
-            const auth = this.data.session ? { session: this.data.session } : null;
+            const auth = (this.data as IAuthData).session ? { session: (this.data as IAuthData).session } : null;
            this.doRequest(auth).finally(() => {
                this.busyChangedCallback?.(false);
            });
@@ -290,7 +329,7 @@ export class InteractiveAuth {
     * be resolved.
     */
    public async poll(): Promise<void> {
-        if (!this.data.session) return;
+        if (!(this.data as IAuthData).session) return;
        // likewise don't poll if there is no auth session in progress
        if (!this.attemptAuthDeferred) return;
        // if we currently have a request in flight, there's no point making
@@ -330,7 +369,7 @@ export class InteractiveAuth {
     * @returns session id
     */
    public getSessionId(): string | undefined {
-        return this.data?.session;
+        return (this.data as IAuthData)?.session;
    }

    /**
@@ -350,7 +389,7 @@ export class InteractiveAuth {
     * @returns any parameters from the server for this stage
     */
    public getStageParams(loginType: string): Record<string, any> | undefined {
-        return this.data.params?.[loginType];
+        return (this.data as IAuthData)?.params?.[loginType];
    }

    public getChosenFlow(): UIAFlow | null {
@@ -391,9 +430,9 @@ export class InteractiveAuth {

        // use the sessionid from the last request, if one is present.
        let auth: IAuthDict;
-        if (this.data.session) {
+        if ((this.data as IAuthData)?.session) {
            auth = {
-                session: this.data.session,
+                session: (this.data as IAuthData).session,
            };
            Object.assign(auth, authData);
        } else {
@@ -451,7 +490,7 @@ export class InteractiveAuth {
                    this.inputs.emailAddress!,
                    this.clientSecret,
                    this.emailAttempt++,
-                    this.data.session!,
+                    (this.data as IAuthData).session!,
                );
                this.emailSid = requestTokenResult.sid;
                logger.trace("Email token request succeeded");
@@ -480,10 +519,12 @@ export class InteractiveAuth {
            this.attemptAuthDeferred!.resolve(result);
            this.attemptAuthDeferred = null;
        } catch (error) {
+            const matrixError = error instanceof MatrixError ? error : null;
+
            // sometimes UI auth errors don't come with flows
-            const errorFlows = (<MatrixError>error).data?.flows ?? null;
-            const haveFlows = this.data.flows || Boolean(errorFlows);
-            if ((<MatrixError>error).httpStatus !== 401 || !(<MatrixError>error).data || !haveFlows) {
+            const errorFlows = matrixError?.data?.flows ?? null;
+            const haveFlows = (this.data as IAuthData)?.flows || Boolean(errorFlows);
+            if (!matrixError || matrixError.httpStatus !== 401 || !matrixError.data || !haveFlows) {
                // doesn't look like an interactive-auth failure.
                if (!background) {
                    this.attemptAuthDeferred?.reject(error);
@@ -494,24 +535,22 @@ export class InteractiveAuth {
                    logger.log("Background poll request failed doing UI auth: ignoring", error);
                }
            }
-            if (!(<MatrixError>error).data) {
-                (<MatrixError>error).data = {};
+            if (matrixError && !matrixError.data) {
+                matrixError.data = {};
            }
            // if the error didn't come with flows, completed flows or session ID,
            // copy over the ones we have. Synapse sometimes sends responses without
            // any UI auth data (eg. when polling for email validation, if the email
            // has not yet been validated). This appears to be a Synapse bug, which
            // we workaround here.
-            if (
-                !(<MatrixError>error).data.flows &&
-                !(<MatrixError>error).data.completed &&
-                !(<MatrixError>error).data.session
-            ) {
-                (<MatrixError>error).data.flows = this.data.flows;
-                (<MatrixError>error).data.completed = this.data.completed;
-                (<MatrixError>error).data.session = this.data.session;
+            if (matrixError && !matrixError.data.flows && !matrixError.data.completed && !matrixError.data.session) {
+                matrixError.data.flows = (this.data as IAuthData).flows;
+                matrixError.data.completed = (this.data as IAuthData).completed;
+                matrixError.data.session = (this.data as IAuthData).session;
+            }
+            if (matrixError) {
+                this.data = matrixError.data;
            }
-            this.data = (<MatrixError>error).data;
            try {
                this.startNextAuthStage();
            } catch (e) {
@@ -618,7 +657,7 @@ export class InteractiveAuth {
     * @throws {@link NoAuthFlowFoundError} If no suitable authentication flow can be found
     */
    private chooseFlow(): UIAFlow {
-        const flows = this.data.flows || [];
+        const flows = (this.data as IAuthData)?.flows || [];

        // we've been given an email or we've already done an email part
        const haveEmail = Boolean(this.inputs.emailAddress) || Boolean(this.emailSid);
@@ -659,7 +698,7 @@ export class InteractiveAuth {
     * @returns login type
     */
    private firstUncompletedStage(flow: UIAFlow): AuthType | string | undefined {
-        const completed = this.data.completed || [];
+        const completed = (this.data as IAuthData)?.completed || [];
        return flow.stages.find((stageType) => !completed.includes(stageType));
    }
 }
@@ -41,6 +41,7 @@ export * from "./models/thread";
 export * from "./models/typed-event-emitter";
 export * from "./models/user";
 export * from "./models/device";
+export * from "./models/search-result";
 export * from "./scheduler";
 export * from "./filter";
 export * from "./timeline-window";
@@ -52,20 +53,41 @@ export * from "./crypto/store/memory-crypto-store";
 export * from "./crypto/store/indexeddb-crypto-store";
 export type { OutgoingRoomKeyRequest } from "./crypto/store/base";
 export * from "./content-repo";
+export * from "./@types/uia";
 export * from "./@types/event";
 export * from "./@types/PushRules";
 export * from "./@types/partials";
 export * from "./@types/requests";
 export * from "./@types/search";
 export * from "./models/room-summary";
+export * from "./models/event-status";
 export * as ContentHelpers from "./content-helpers";
 export * as SecretStorage from "./secret-storage";
 export type { ICryptoCallbacks } from "./crypto"; // used to be located here
-export { createNewMatrixCall } from "./webrtc/call";
+export { createNewMatrixCall, CallEvent } from "./webrtc/call";
 export type { MatrixCall } from "./webrtc/call";
-export { GroupCallEvent, GroupCallIntent, GroupCallState, GroupCallType } from "./webrtc/groupCall";
-export type { GroupCall } from "./webrtc/groupCall";
+export {
+    GroupCall,
+    GroupCallEvent,
+    GroupCallIntent,
+    GroupCallState,
+    GroupCallType,
+    GroupCallStatsReportEvent,
+} from "./webrtc/groupCall";
 export { CryptoEvent } from "./crypto";
+export { SyncState, SetPresence } from "./sync";
+export type { ISyncStateData as SyncStateData } from "./sync";
+export { SlidingSyncEvent } from "./sliding-sync";
+export { MediaHandlerEvent } from "./webrtc/mediaHandler";
+export { CallFeedEvent } from "./webrtc/callFeed";
+export { StatsReport } from "./webrtc/stats/statsReport";
+export { Relations, RelationsEvent } from "./models/relations";
+export { TypedEventEmitter } from "./models/typed-event-emitter";
+export { LocalStorageErrors } from "./store/local-storage-events-emitter";
+export { IdentityProviderBrand, SSOAction } from "./@types/auth";
+export type { ISSOFlow as SSOFlow, LoginFlow } from "./@types/auth";
+export type { IHierarchyRelation as HierarchyRelation, IHierarchyRoom as HierarchyRoom } from "./@types/spaces";
+export { LocationAssetType } from "./@types/location";

 /**
 * Types supporting cryptography.
@@ -984,11 +984,20 @@ export class EventTimelineSet extends TypedEventEmitter<EmittedEvents, EventTime
            );
        }

-        const { threadId, shouldLiveInRoom } = this.room.eventShouldLiveIn(event);
+        const { threadId, shouldLiveInRoom, shouldLiveInThread } = this.room.eventShouldLiveIn(event);

        if (this.thread) {
            return this.thread.id === threadId;
        }
+
+        if (!shouldLiveInRoom && !shouldLiveInThread) {
+            logger.warn(
+                `EventTimelineSet:canContain event encountered which cannot be added to any timeline roomId=${
+                    this.room?.roomId
+                } eventId=${event.getId()} threadId=${event.threadRootId}`,
+            );
+        }
+
        return shouldLiveInRoom;
    }
 }
@@ -29,12 +29,13 @@ import {
    EventType,
    MsgType,
    RelationType,
+    ToDeviceMessageId,
    UNSIGNED_THREAD_ID_FIELD,
 } from "../@types/event";
 import { Crypto } from "../crypto";
 import { deepSortedObjectEntries, internaliseString } from "../utils";
 import { RoomMember } from "./room-member";
-import { Thread, ThreadEvent, ThreadEventHandlerMap, THREAD_RELATION_TYPE } from "./thread";
+import { Thread, THREAD_RELATION_TYPE, ThreadEvent, ThreadEventHandlerMap } from "./thread";
 import { IActionsObject } from "../pushprocessor";
 import { TypedReEmitter } from "../ReEmitter";
 import { MatrixError } from "../http-api";
@@ -56,16 +57,18 @@ export interface IContent {
    "displayname"?: string;
    "m.relates_to"?: IEventRelation;

-    "org.matrix.msc3952.mentions"?: IMentions;
+    "m.mentions"?: IMentions;
 }

 type StrippedState = Required<Pick<IEvent, "content" | "state_key" | "type" | "sender">>;

 export interface IUnsigned {
+    [key: string]: any;
    "age"?: number;
    "prev_sender"?: string;
    "prev_content"?: IContent;
    "redacted_because"?: IEvent;
+    "replaces_state"?: string;
    "transaction_id"?: string;
    "invite_room_state"?: StrippedState[];
    "m.relations"?: Record<RelationType | string, any>; // No common pattern for aggregated relations
@@ -517,16 +520,15 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
     * ```
     */
    public getDetails(): string {
-        let details = `id=${this.getId()} type=${this.getWireType()} sender=${this.getSender()}`;
        const room = this.getRoomId();
        if (room) {
-            details += ` room=${room}`;
+            // in-room event
+            return `id=${this.getId()} type=${this.getWireType()} sender=${this.getSender()} room=${room} ts=${this.getDate()?.toISOString()}`;
+        } else {
+            // to-device event
+            const msgid = this.getContent()[ToDeviceMessageId];
+            return `msgid=${msgid} type=${this.getWireType()} sender=${this.getSender()}`;
        }
-        const date = this.getDate();
-        if (date) {
-            details += ` ts=${date.toISOString()}`;
-        }
-        return details;
    }

    /**
@@ -576,6 +578,10 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
     * Get the event ID of the thread head
     */
    public get threadRootId(): string | undefined {
+        // don't allow state events to be threaded as per the spec
+        if (this.isState()) {
+            return undefined;
+        }
        const relatesTo = this.getWireContent()?.["m.relates_to"];
        if (relatesTo?.rel_type === THREAD_RELATION_TYPE.name) {
            return relatesTo.event_id;
@@ -597,6 +603,11 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
     * A helper to check if an event is a thread's head or not
     */
    public get isThreadRoot(): boolean {
+        // don't allow state events to be threaded as per the spec
+        if (this.isState()) {
+            return false;
+        }
+
        const threadDetails = this.getServerAggregatedRelation<IThreadBundledRelationship>(THREAD_RELATION_TYPE.name);

        // Bundled relationships only returned when the sync response is limited
@@ -1365,8 +1376,12 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
        // Relation info is lifted out of the encrypted content when sent to
        // encrypted rooms, so we have to check `getWireContent` for this.
        const relation = this.getWireContent()?.["m.relates_to"];
-        if (this.isState() && relation?.rel_type === RelationType.Replace) {
-            // State events cannot be m.replace relations
+        if (
+            this.isState() &&
+            !!relation?.rel_type &&
+            ([RelationType.Replace, RelationType.Thread] as string[]).includes(relation.rel_type)
+        ) {
+            // State events cannot be m.replace or m.thread relations
            return false;
        }
        return !!(relation?.rel_type && relation.event_id && (relType ? relation.rel_type === relType : true));
@@ -1618,6 +1633,10 @@ export class MatrixEvent extends TypedEventEmitter<MatrixEventEmittedEvents, Mat
     * @param thread - the thread
     */
    public setThread(thread?: Thread): void {
+        // don't allow state events to be threaded as per the spec
+        if (this.isState()) {
+            return;
+        }
        if (this.thread) {
            this.reEmitter.stopReEmitting(this.thread, [ThreadEvent.Update]);
        }
@@ -57,9 +57,10 @@ export abstract class ReadReceipt<
    // which pass in an event ID and get back some receipts, so we also store
    // a pre-cached list for this purpose.
    // Map: receipt type → user Id → receipt
-    private receipts = new MapWithDefault<string, Map<string, [WrappedReceipt | null, WrappedReceipt | null]>>(
-        () => new Map(),
-    );
+    private receipts = new MapWithDefault<
+        string,
+        Map<string, [realReceipt: WrappedReceipt | null, syntheticReceipt: WrappedReceipt | null]>
+    >(() => new Map());
    private receiptCacheByEventId: ReceiptCache = new Map();

    public abstract getUnfilteredTimelineSet(): EventTimelineSet;
@@ -85,6 +86,13 @@ export abstract class ReadReceipt<
        return syntheticReceipt ?? realReceipt;
    }

+    private compareReceipts(a: WrappedReceipt, b: WrappedReceipt): number {
+        // Try compare them in our unfiltered timeline set order, falling back to receipt timestamp which should be
+        // relatively sane as receipts are set only by the originating homeserver so as long as its clock doesn't
+        // jump around then it should be valid.
+        return this.getUnfilteredTimelineSet().compareEventOrdering(a.eventId, b.eventId) ?? a.data.ts - b.data.ts;
+    }
+
    /**
     * Get the ID of the event that a given user has read up to, or null if we
     * have received no read receipts from them.
@@ -99,19 +107,13 @@ export abstract class ReadReceipt<
        // receipt type here again. IMHO this should be done by the server in
        // some more intelligent manner or the client should just use timestamps

-        const timelineSet = this.getUnfilteredTimelineSet();
        const publicReadReceipt = this.getReadReceiptForUserId(userId, ignoreSynthesized, ReceiptType.Read);
        const privateReadReceipt = this.getReadReceiptForUserId(userId, ignoreSynthesized, ReceiptType.ReadPrivate);

        // If we have both, compare them
        let comparison: number | null | undefined;
        if (publicReadReceipt?.eventId && privateReadReceipt?.eventId) {
-            comparison = timelineSet.compareEventOrdering(publicReadReceipt?.eventId, privateReadReceipt?.eventId);
-        }
-
-        // If we didn't get a comparison try to compare the ts of the receipts
-        if (!comparison && publicReadReceipt?.data?.ts && privateReadReceipt?.data?.ts) {
-            comparison = publicReadReceipt?.data?.ts - privateReadReceipt?.data?.ts;
+            comparison = this.compareReceipts(publicReadReceipt, privateReadReceipt);
        }

        // The public receipt is more likely to drift out of date so the private
@@ -142,20 +144,20 @@ export abstract class ReadReceipt<
            existingReceipt = pair[ReceiptPairSyntheticIndex] ?? pair[ReceiptPairRealIndex];
        }

-        if (existingReceipt) {
-            // we only want to add this receipt if we think it is later than the one we already have.
-            // This is managed server-side, but because we synthesize RRs locally we have to do it here too.
-            const ordering = this.getUnfilteredTimelineSet().compareEventOrdering(existingReceipt.eventId, eventId);
-            if (ordering !== null && ordering >= 0) {
-                return;
-            }
-        }
-
        const wrappedReceipt: WrappedReceipt = {
            eventId,
            data: receipt,
        };

+        if (existingReceipt) {
+            // We only want to add this receipt if we think it is later than the one we already have.
+            // This is managed server-side, but because we synthesize RRs locally we have to do it here too.
+            const ordering = this.compareReceipts(existingReceipt, wrappedReceipt);
+            if (ordering >= 0) {
+                return;
+            }
+        }
+
        const realReceipt = synthetic ? pair[ReceiptPairRealIndex] : wrappedReceipt;
        const syntheticReceipt = synthetic ? wrappedReceipt : pair[ReceiptPairSyntheticIndex];

@@ -1877,6 +1877,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     * Takes the given thread root events and creates threads for them.
     */
    public processThreadRoots(events: MatrixEvent[], toStartOfTimeline: boolean): void {
+        if (!this.client.supportsThreads()) return;
        for (const rootEvent of events) {
            EventTimeline.setEventMetadata(rootEvent, this.currentState, toStartOfTimeline);
            if (!this.getThread(rootEvent.getId()!)) {
@@ -2031,6 +2032,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
     * @internal
     */
    private async fetchRoomThreadList(filter?: ThreadFilterType): Promise<void> {
+        if (!this.client.supportsThreads()) return;
        if (this.threadsTimelineSets.length === 0) return;

        const timelineSet = filter === ThreadFilterType.My ? this.threadsTimelineSets[1] : this.threadsTimelineSets[0];
@@ -2093,6 +2095,14 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
        }
    }

+    /**
+     * Determine which timeline(s) a given event should live in
+     * Thread roots live in both the main timeline and their corresponding thread timeline
+     * Relations, redactions, replies to thread relation events live only in the thread timeline
+     * Relations (other than m.thread), redactions, replies to a thread root live only in the main timeline
+     * Relations, redactions, replies where the parent cannot be found live in no timelines but should be aggregated regardless.
+     * Otherwise, the event lives in the main timeline only.
+     */
    public eventShouldLiveIn(
        event: MatrixEvent,
        events?: MatrixEvent[],
@@ -2109,7 +2119,7 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
            };
        }

-        // A thread root is always shown in both timelines
+        // A thread root is the only event shown in both timelines
        if (event.isThreadRoot || roots?.has(event.getId()!)) {
            return {
                shouldLiveInRoom: true,
@@ -2118,8 +2128,29 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
            };
        }

-        // A thread relation (1st and 2nd order) is always only shown in a thread
+        const isThreadRelation = event.isRelation(THREAD_RELATION_TYPE.name);
+        const parentEventId = event.getAssociatedId();
        const threadRootId = event.threadRootId;
+
+        // Where the parent is the thread root and this is a non-thread relation this should live only in the main timeline
+        if (!!parentEventId && !isThreadRelation && (threadRootId === parentEventId || roots?.has(parentEventId!))) {
+            return {
+                shouldLiveInRoom: true,
+                shouldLiveInThread: false,
+            };
+        }
+
+        let parentEvent: MatrixEvent | undefined;
+        if (parentEventId) {
+            parentEvent = this.findEventById(parentEventId) ?? events?.find((e) => e.getId() === parentEventId);
+        }
+
+        // Treat non-thread-relations, redactions, and replies as extensions of their parents so evaluate parentEvent instead
+        if (parentEvent && !isThreadRelation) {
+            return this.eventShouldLiveIn(parentEvent, events, roots);
+        }
+
+        // A thread relation (1st and 2nd order) is always only shown in a thread
        if (threadRootId != undefined) {
            return {
                shouldLiveInRoom: false,
@@ -2128,33 +2159,16 @@ export class Room extends ReadReceipt<RoomEmittedEvents, RoomEventHandlerMap> {
            };
        }

-        const parentEventId = event.getAssociatedId();
-        let parentEvent: MatrixEvent | undefined;
-        if (parentEventId) {
-            parentEvent = this.findEventById(parentEventId) ?? events?.find((e) => e.getId() === parentEventId);
-        }
-
-        // Treat relations and redactions as extensions of their parents so evaluate parentEvent instead
-        if (parentEvent && (event.isRelation() || event.isRedaction())) {
-            return this.eventShouldLiveIn(parentEvent, events, roots);
-        }
-
-        if (!event.isRelation()) {
+        // Due to replies not being typical relations and being used as fallbacks for threads relations
+        // If we bypass the if case above then we know we are not a thread, so if we are still a reply
+        // then we know that we must be in the main timeline. Same goes if we have no associated parent event.
+        if (!parentEventId || !!event.replyEventId) {
            return {
                shouldLiveInRoom: true,
                shouldLiveInThread: false,
            };
        }

-        // Edge case where we know the event is a relation but don't have the parentEvent
-        if (roots?.has(event.relationEventId!)) {
-            return {
-                shouldLiveInRoom: true,
-                shouldLiveInThread: true,
-                threadId: event.relationEventId,
-            };
-        }
-
        // We've exhausted all scenarios,
        // we cannot assume that it lives in the main timeline as this may be a relation for an unknown thread
        // adding the event in the wrong timeline causes stuck notifications and can break ability to send read receipts
@@ -98,6 +98,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
    public readonly room: Room;
    public readonly client: MatrixClient;
    private readonly pendingEventOrdering: PendingEventOrdering;
+    private processRootEventPromise?: Promise<void>;

    public initialEventsFetched = !Thread.hasServerSideSupport;
    /**
@@ -134,6 +135,7 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
        this.room.on(MatrixEventEvent.BeforeRedaction, this.onBeforeRedaction);
        this.room.on(RoomEvent.Redaction, this.onRedaction);
        this.room.on(RoomEvent.LocalEchoUpdated, this.onLocalEcho);
+        this.room.on(RoomEvent.TimelineReset, this.onTimelineReset);
        this.timelineSet.on(RoomEvent.Timeline, this.onTimelineEvent);

        this.processReceipts(opts.receipts);
@@ -144,6 +146,12 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
        this.setEventMetadata(this.rootEvent);
    }

+    private onTimelineReset = async (): Promise<void> => {
+        // We hit a gappy sync, ask the server for an update
+        await this.processRootEventPromise;
+        this.processRootEventPromise = undefined;
+    };
+
    private async fetchRootEvent(): Promise<void> {
        this.rootEvent = this.room.findEventById(this.id);
        // If the rootEvent does not exist in the local stores, then fetch it from the server.
@@ -197,6 +205,11 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
            this._currentUserParticipated = false;
            this.emit(ThreadEvent.Delete, this);
        } else {
+            if (this.lastEvent?.getId() === event.getAssociatedId()) {
+                // XXX: If our last event got redacted we query the server for the last event once again
+                await this.processRootEventPromise;
+                this.processRootEventPromise = undefined;
+            }
            await this.updateThreadMetadata();
        }
    };
@@ -212,6 +225,9 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
            if (sender && room && this.shouldSendLocalEchoReceipt(sender, event)) {
                room.addLocalEchoReceipt(sender, event, ReceiptType.Read);
            }
+            if (event.getId() !== this.id && event.isRelation(THREAD_RELATION_TYPE.name)) {
+                this.replyCount++;
+            }
        }
        this.onEcho(event, toStartOfTimeline ?? false);
    };
@@ -245,6 +261,8 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
        await this.updateThreadMetadata();
        if (!event.isRelation(THREAD_RELATION_TYPE.name)) return; // don't send a new reply event for reactions or edits
        if (toStartOfTimeline) return; // ignore messages added to the start of the timeline
+        // Clear the lastEvent and instead start tracking locally using lastReply
+        this.lastEvent = undefined;
        this.emit(ThreadEvent.NewReply, this, event);
    };

@@ -351,10 +369,14 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
            return;
        }

-        // If no thread support exists we want to count all thread relation
-        // added as a reply. We can't rely on the bundled relationships count
-        if ((!Thread.hasServerSideSupport || !this.rootEvent) && event.isRelation(THREAD_RELATION_TYPE.name)) {
-            this.replyCount++;
+        if (
+            event.getId() !== this.id &&
+            event.isRelation(THREAD_RELATION_TYPE.name) &&
+            !toStartOfTimeline &&
+            isNewestReply
+        ) {
+            // Clear the last event as we have the latest end of the timeline
+            this.lastEvent = undefined;
        }

        if (emit) {
@@ -475,18 +497,26 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
        }
    }

-    private async updateThreadMetadata(): Promise<void> {
-        this.updatePendingReplyCount();
-
+    private async updateThreadFromRootEvent(): Promise<void> {
        if (Thread.hasServerSideSupport) {
            // Ensure we show *something* as soon as possible, we'll update it as soon as we get better data, but we
            // don't want the thread preview to be empty if we can avoid it
-            if (!this.initialEventsFetched) {
+            if (!this.initialEventsFetched && !this.lastEvent) {
                await this.processRootEvent();
            }
            await this.fetchRootEvent();
        }
        await this.processRootEvent();
+    }
+
+    private async updateThreadMetadata(): Promise<void> {
+        this.updatePendingReplyCount();
+
+        if (!this.processRootEventPromise) {
+            // We only want to do this once otherwise we end up rolling back to the last unsigned summary we have for the thread
+            this.processRootEventPromise = this.updateThreadFromRootEvent();
+        }
+        await this.processRootEventPromise;

        if (!this.initialEventsFetched) {
            this.initialEventsFetched = true;
@@ -572,7 +602,9 @@ export class Thread extends ReadReceipt<ThreadEmittedEvents, ThreadEventHandlerM
    /**
     * Return last reply to the thread, if known.
     */
-    public lastReply(matches: (ev: MatrixEvent) => boolean = (): boolean => true): MatrixEvent | null {
+    public lastReply(
+        matches: (ev: MatrixEvent) => boolean = (ev): boolean => ev.isRelation(RelationType.Thread),
+    ): MatrixEvent | null {
        for (let i = this.timeline.length - 1; i >= 0; i--) {
            const event = this.timeline[i];
            if (matches(event)) {
@@ -217,6 +217,10 @@ export class TypedEventEmitter<
     * @returns a reference to the `EventEmitter`, so that calls can be chained.
     */
    public removeAllListeners(event?: Events | EventEmitterEvents): this {
+        // EventEmitter::removeAllListeners uses `arguments.length` to determine undefined case
+        if (event === undefined) {
+            return super.removeAllListeners();
+        }
        return super.removeAllListeners(event);
    }

@@ -14,13 +14,24 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

+import { Log, OidcClient, SigninResponse, SigninState, WebStorageStateStore } from "oidc-client-ts";
+
 import { IDelegatedAuthConfig } from "../client";
-import { Method } from "../http-api";
 import { subtleCrypto, TextEncoder } from "../crypto/crypto";
 import { logger } from "../logger";
 import { randomString } from "../randomstring";
 import { OidcError } from "./error";
-import { ValidatedIssuerConfig } from "./validate";
+import {
+    validateIdToken,
+    ValidatedIssuerMetadata,
+    validateStoredUserState,
+    UserState,
+    BearerTokenResponse,
+    validateBearerTokenResponse,
+} from "./validate";
+
+// reexport for backwards compatibility
+export type { BearerTokenResponse };

 /**
 * Authorization parameters which are used in the authentication request of an OIDC auth code flow.
@@ -35,6 +46,11 @@ export type AuthorizationParams = {
    nonce: string;
 };

+/**
+ * @experimental
+ * Generate the scope used in authorization request with OIDC OP
+ * @returns scope
+ */
 const generateScope = (): string => {
    const deviceId = randomString(10);
    return `openid urn:matrix:org.matrix.msc2967.client:api:* urn:matrix:org.matrix.msc2967.client:device:${deviceId}`;
@@ -74,6 +90,7 @@ export const generateAuthorizationParams = ({ redirectUri }: { redirectUri: stri
 });

 /**
+ * @deprecated use generateOidcAuthorizationUrl
 * Generate a URL to attempt authorization with the OP
 * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
 * @param authorizationUrl - endpoint to attempt authorization with the OP
@@ -102,36 +119,48 @@ export const generateAuthorizationUrl = async (
 };

 /**
- * The expected response type from the token endpoint during authorization code flow
- * Normalized to always use capitalized 'Bearer' for token_type
- *
- * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
- * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
+ * @experimental
+ * Generate a URL to attempt authorization with the OP
+ * See https://openid.net/specs/openid-connect-basic-1_0.html#CodeRequest
+ * @param oidcClientSettings - oidc configuration
+ * @param homeserverName - used as state
+ * @returns a Promise with the url as a string
 */
-export type BearerTokenResponse = {
-    token_type: "Bearer";
-    access_token: string;
-    scope: string;
-    refresh_token?: string;
-    expires_in?: number;
-    id_token?: string;
-};
+export const generateOidcAuthorizationUrl = async ({
+    metadata,
+    redirectUri,
+    clientId,
+    homeserverUrl,
+    identityServerUrl,
+    nonce,
+}: {
+    clientId: string;
+    metadata: ValidatedIssuerMetadata;
+    homeserverUrl: string;
+    identityServerUrl?: string;
+    redirectUri: string;
+    nonce: string;
+}): Promise<string> => {
+    const scope = await generateScope();
+    const oidcClient = new OidcClient({
+        ...metadata,
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        authority: metadata.issuer,
+        response_mode: "query",
+        response_type: "code",
+        scope,
+        stateStore: new WebStorageStateStore({ prefix: "mx_oidc_", store: window.sessionStorage }),
+    });
+    const userState: UserState = { homeserverUrl, nonce, identityServerUrl };
+    const request = await oidcClient.createSigninRequest({
+        state: userState,
+        nonce,
+    });

-/**
- * Expected response type from the token endpoint during authorization code flow
- * as it comes over the wire.
- * Should be normalized to use capital case 'Bearer' for token_type property
- *
- * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
- * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
- */
-type WireBearerTokenResponse = BearerTokenResponse & {
-    token_type: "Bearer" | "bearer";
+    return request.url;
 };

-const isResponseObject = (response: unknown): response is Record<string, unknown> =>
-    !!response && typeof response === "object";
-
 /**
 * Normalize token_type to use capital case to make consuming the token response easier
 * token_type is case insensitive, and it is spec-compliant for OPs to return token_type: "bearer"
@@ -141,21 +170,18 @@ const isResponseObject = (response: unknown): response is Record<string, unknown
 * @param response - validated token response
 * @returns response with token_type set to 'Bearer'
 */
-const normalizeBearerTokenResponseTokenType = (response: WireBearerTokenResponse): BearerTokenResponse => ({
-    ...response,
-    token_type: "Bearer",
-});
-
-const isValidBearerTokenResponse = (response: unknown): response is WireBearerTokenResponse =>
-    isResponseObject(response) &&
-    typeof response["token_type"] === "string" &&
-    // token_type is case insensitive, some OPs return `token_type: "bearer"`
-    response["token_type"].toLowerCase() === "bearer" &&
-    typeof response["access_token"] === "string" &&
-    (!("refresh_token" in response) || typeof response["refresh_token"] === "string") &&
-    (!("expires_in" in response) || typeof response["expires_in"] === "number");
+const normalizeBearerTokenResponseTokenType = (response: SigninResponse): BearerTokenResponse =>
+    ({
+        id_token: response.id_token,
+        scope: response.scope,
+        expires_at: response.expires_at,
+        refresh_token: response.refresh_token,
+        access_token: response.access_token,
+        token_type: "Bearer",
+    } as BearerTokenResponse);

 /**
+ * @experimental
 * Attempt to exchange authorization code for bearer token.
 *
 * Takes the authorization code returned by the OpenID Provider via the authorization URL, and makes a
@@ -168,43 +194,71 @@ const isValidBearerTokenResponse = (response: unknown): response is WireBearerTo
 */
 export const completeAuthorizationCodeGrant = async (
    code: string,
-    {
-        clientId,
-        codeVerifier,
-        redirectUri,
-        delegatedAuthConfig,
-    }: {
-        clientId: string;
-        codeVerifier: string;
-        redirectUri: string;
-        delegatedAuthConfig: IDelegatedAuthConfig & ValidatedIssuerConfig;
-    },
-): Promise<BearerTokenResponse> => {
-    const params = new URLSearchParams();
-    params.append("grant_type", "authorization_code");
-    params.append("client_id", clientId);
-    params.append("code_verifier", codeVerifier);
-    params.append("redirect_uri", redirectUri);
-    params.append("code", code);
-    const metadata = params.toString();
+    state: string,
+): Promise<{
+    oidcClientSettings: IDelegatedAuthConfig & { clientId: string };
+    tokenResponse: BearerTokenResponse;
+    homeserverUrl: string;
+    identityServerUrl?: string;
+}> => {
+    /**
+     * Element Web strips and changes the url on starting the app
+     * Use the code and state from query params to rebuild a url
+     * so that oidc-client can parse it
+     */
+    const reconstructedUrl = new URL(window.location.origin);
+    reconstructedUrl.searchParams.append("code", code);
+    reconstructedUrl.searchParams.append("state", state);

-    const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+    // set oidc-client to use our logger
+    Log.setLogger(logger);
+    try {
+        const response = new SigninResponse(reconstructedUrl.searchParams);

-    const response = await fetch(delegatedAuthConfig.tokenEndpoint, {
-        method: Method.Post,
-        headers,
-        body: metadata,
-    });
+        const stateStore = new WebStorageStateStore({ prefix: "mx_oidc_", store: window.sessionStorage });

-    if (response.status >= 400) {
+        // retrieve the state we put in storage at the start of oidc auth flow
+        const stateString = await stateStore.get(response.state!);
+        if (!stateString) {
+            throw new Error(OidcError.MissingOrInvalidStoredState);
+        }
+
+        // hydrate the sign in state and create a client
+        // the stored sign in state includes oidc configuration we set at the start of the oidc login flow
+        const signInState = SigninState.fromStorageString(stateString);
+        const client = new OidcClient({ ...signInState, stateStore });
+
+        // validate the code and state, and attempt to swap the code for tokens
+        const signinResponse = await client.processSigninResponse(reconstructedUrl.href);
+
+        // extra values we stored at the start of the login flow
+        // used to complete login in the client
+        const userState = signinResponse.userState;
+        validateStoredUserState(userState);
+
+        // throws when response is invalid
+        validateBearerTokenResponse(signinResponse);
+        // throws when token is invalid
+        validateIdToken(signinResponse.id_token, client.settings.authority, client.settings.client_id, userState.nonce);
+        const normalizedTokenResponse = normalizeBearerTokenResponseTokenType(signinResponse);
+
+        return {
+            oidcClientSettings: {
+                clientId: client.settings.client_id,
+                issuer: client.settings.authority,
+            },
+            tokenResponse: normalizedTokenResponse,
+            homeserverUrl: userState.homeserverUrl,
+            identityServerUrl: userState.identityServerUrl,
+        };
+    } catch (error) {
+        logger.error("Oidc login failed", error);
+        const errorType = (error as Error).message;
+
+        // rethrow errors that we recognise
+        if (Object.values(OidcError).includes(errorType as any)) {
+            throw error;
+        }
        throw new Error(OidcError.CodeExchangeFailed);
    }
-
-    const token = await response.json();
-
-    if (isValidBearerTokenResponse(token)) {
-        return normalizeBearerTokenResponseTokenType(token);
-    }
-
-    throw new Error(OidcError.InvalidBearerTokenResponse);
 };
@@ -0,0 +1,61 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { MetadataService, OidcClientSettingsStore, SigningKey } from "oidc-client-ts";
+
+import { IDelegatedAuthConfig } from "../client";
+import { isValidatedIssuerMetadata, ValidatedIssuerMetadata, validateWellKnownAuthentication } from "./validate";
+
+/**
+ * @experimental
+ * Discover and validate delegated auth configuration
+ * - m.authentication config is present and valid
+ * - delegated auth issuer openid-configuration is reachable
+ * - delegated auth issuer openid-configuration is configured correctly for us
+ * When successful, validated metadata is returned
+ * @param wellKnown - configuration object as returned
+ * by the .well-known auto-discovery endpoint
+ * @returns validated authentication metadata and optionally signing keys
+ * @throws when delegated auth config is invalid or unreachable
+ */
+export const discoverAndValidateAuthenticationConfig = async (
+    authenticationConfig?: IDelegatedAuthConfig,
+): Promise<
+    IDelegatedAuthConfig & {
+        metadata: ValidatedIssuerMetadata;
+        signingKeys?: SigningKey[];
+    }
+> => {
+    const homeserverAuthenticationConfig = validateWellKnownAuthentication(authenticationConfig);
+
+    // create a temporary settings store so we can use metadata service for discovery
+    const settings = new OidcClientSettingsStore({
+        authority: homeserverAuthenticationConfig.issuer,
+        redirect_uri: "", // Not known yet, this is here to make the type checker happy
+        client_id: "", // Not known yet, this is here to make the type checker happy
+    });
+    const metadataService = new MetadataService(settings);
+    const metadata = await metadataService.getMetadata();
+    const signingKeys = (await metadataService.getSigningKeys()) ?? undefined;
+
+    isValidatedIssuerMetadata(metadata);
+
+    return {
+        ...homeserverAuthenticationConfig,
+        metadata,
+        signingKeys,
+    };
+};
@@ -23,5 +23,7 @@ export enum OidcError {
    DynamicRegistrationFailed = "Dynamic registration failed",
    DynamicRegistrationInvalid = "Dynamic registration invalid response",
    CodeExchangeFailed = "Failed to exchange code for token",
-    InvalidBearerTokenResponse = "Invalid bearer token",
+    InvalidBearerTokenResponse = "Invalid bearer token response",
+    InvalidIdToken = "Invalid ID token",
+    MissingOrInvalidStoredState = "State required to finish logging in is not found in storage.",
 }
@@ -14,7 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { IClientWellKnown, IDelegatedAuthConfig, M_AUTHENTICATION } from "../client";
+import jwtDecode from "jwt-decode";
+import { OidcMetadata, SigninResponse } from "oidc-client-ts";
+
+import { IDelegatedAuthConfig } from "../client";
 import { logger } from "../logger";
 import { OidcError } from "./error";

@@ -37,9 +40,7 @@ export type ValidatedIssuerConfig = {
 * @returns config - when present and valid
 * @throws when config is not found or invalid
 */
-export const validateWellKnownAuthentication = (wellKnown: IClientWellKnown): IDelegatedAuthConfig => {
-    const authentication = M_AUTHENTICATION.findIn<IDelegatedAuthConfig>(wellKnown);
-
+export const validateWellKnownAuthentication = (authentication?: IDelegatedAuthConfig): IDelegatedAuthConfig => {
    if (!authentication) {
        throw new Error(OidcError.NotSupported);
    }
@@ -61,14 +62,14 @@ const isRecord = (value: unknown): value is Record<string, unknown> =>
    !!value && typeof value === "object" && !Array.isArray(value);
 const requiredStringProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {
    if (!wellKnown[key] || !optionalStringProperty(wellKnown, key)) {
-        logger.error(`OIDC issuer configuration: ${key} is invalid`);
+        logger.error(`Missing or invalid property: ${key}`);
        return false;
    }
    return true;
 };
 const optionalStringProperty = (wellKnown: Record<string, unknown>, key: string): boolean => {
    if (!!wellKnown[key] && typeof wellKnown[key] !== "string") {
-        logger.error(`OIDC issuer configuration: ${key} is invalid`);
+        logger.error(`Invalid property: ${key}`);
        return false;
    }
    return true;
@@ -76,14 +77,14 @@ const optionalStringProperty = (wellKnown: Record<string, unknown>, key: string)
 const requiredArrayValue = (wellKnown: Record<string, unknown>, key: string, value: any): boolean => {
    const array = wellKnown[key];
    if (!array || !Array.isArray(array) || !array.includes(value)) {
-        logger.error(`OIDC issuer configuration: ${key} is invalid. ${value} is required.`);
+        logger.error(`Invalid property: ${key}. ${value} is required.`);
        return false;
    }
    return true;
 };

 /**
- * Validates issue `.well-known/openid-configuration`
+ * Validates issuer `.well-known/openid-configuration`
 * As defined in RFC5785 https://openid.net/specs/openid-connect-discovery-1_0.html
 * validates that OP is compatible with Element's OIDC flow
 * @param wellKnown - json object
@@ -99,6 +100,7 @@ export const validateOIDCIssuerWellKnown = (wellKnown: unknown): ValidatedIssuer
    const isInvalid = [
        requiredStringProperty(wellKnown, "authorization_endpoint"),
        requiredStringProperty(wellKnown, "token_endpoint"),
+        requiredStringProperty(wellKnown, "revocation_endpoint"),
        optionalStringProperty(wellKnown, "registration_endpoint"),
        requiredArrayValue(wellKnown, "response_types_supported", "code"),
        requiredArrayValue(wellKnown, "grant_types_supported", "authorization_code"),
@@ -116,3 +118,191 @@ export const validateOIDCIssuerWellKnown = (wellKnown: unknown): ValidatedIssuer
    logger.error("Issuer configuration not valid");
    throw new Error(OidcError.OpSupport);
 };
+
+/**
+ * Metadata from OIDC authority discovery
+ * With validated properties required in type
+ */
+export type ValidatedIssuerMetadata = Partial<OidcMetadata> &
+    Pick<
+        OidcMetadata,
+        | "issuer"
+        | "authorization_endpoint"
+        | "token_endpoint"
+        | "registration_endpoint"
+        | "revocation_endpoint"
+        | "response_types_supported"
+        | "grant_types_supported"
+        | "code_challenge_methods_supported"
+    >;
+
+/**
+ * Wraps validateOIDCIssuerWellKnown in a type assertion
+ * that asserts expected properties are present
+ * (Typescript assertions cannot be arrow functions)
+ * @param metadata - issuer openid-configuration response
+ * @throws when metadata validation fails
+ */
+export function isValidatedIssuerMetadata(
+    metadata: Partial<OidcMetadata>,
+): asserts metadata is ValidatedIssuerMetadata {
+    validateOIDCIssuerWellKnown(metadata);
+}
+
+/**
+ * Standard JWT claims.
+ *
+ * @see https://datatracker.ietf.org/doc/html/rfc7519#section-4.1
+ */
+interface JwtClaims {
+    [claim: string]: unknown;
+    /** The "iss" (issuer) claim identifies the principal that issued the JWT. */
+    iss?: string;
+    /** The "sub" (subject) claim identifies the principal that is the subject of the JWT. */
+    sub?: string;
+    /** The "aud" (audience) claim identifies the recipients that the JWT is intended for. */
+    aud?: string | string[];
+    /** The "exp" (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. */
+    exp?: number;
+    // unused claims excluded
+}
+interface IdTokenClaims extends JwtClaims {
+    nonce?: string;
+}
+
+const decodeIdToken = (token: string): IdTokenClaims => {
+    try {
+        return jwtDecode<IdTokenClaims>(token);
+    } catch (error) {
+        logger.error("Could not decode id_token", error);
+        throw error;
+    }
+};
+
+/**
+ * Validate idToken
+ * https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation
+ * @param idToken - id token from token endpoint
+ * @param issuer - issuer for the OP as found during discovery
+ * @param clientId - this client's id as registered with the OP
+ * @param nonce - nonce used in the authentication request
+ * @throws when id token is invalid
+ */
+export const validateIdToken = (idToken: string | undefined, issuer: string, clientId: string, nonce: string): void => {
+    try {
+        if (!idToken) {
+            throw new Error("No ID token");
+        }
+        const claims = decodeIdToken(idToken);
+
+        // The Issuer Identifier for the OpenID Provider MUST exactly match the value of the iss (issuer) Claim.
+        if (claims.iss !== issuer) {
+            throw new Error("Invalid issuer");
+        }
+        /**
+         * The Client MUST validate that the aud (audience) Claim contains its client_id value registered at the Issuer identified by the iss (issuer) Claim as an audience.
+         * The aud (audience) Claim MAY contain an array with more than one element.
+         * The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
+         * EW: Don't accept tokens with other untrusted audiences
+         * */
+        if (claims.aud !== clientId) {
+            throw new Error("Invalid audience");
+        }
+
+        /**
+         * If a nonce value was sent in the Authentication Request, a nonce Claim MUST be present and its value checked
+         * to verify that it is the same value as the one that was sent in the Authentication Request.
+         */
+        if (claims.nonce !== nonce) {
+            throw new Error("Invalid nonce");
+        }
+
+        /**
+         * The current time MUST be before the time represented by the exp Claim.
+         *  exp is an epoch timestamp in seconds
+         * */
+        if (!claims.exp || Date.now() > claims.exp * 1000) {
+            throw new Error("Invalid expiry");
+        }
+    } catch (error) {
+        logger.error("Invalid ID token", error);
+        throw new Error(OidcError.InvalidIdToken);
+    }
+};
+
+/**
+ * State we ask OidcClient to store when starting oidc authorization flow (in `generateOidcAuthorizationUrl`)
+ * so that we can access it on return from the OP and complete login
+ */
+export type UserState = {
+    /**
+     * Remember which server we were trying to login to
+     */
+    homeserverUrl: string;
+    identityServerUrl?: string;
+    /**
+     * Used to validate id token
+     */
+    nonce: string;
+};
+/**
+ * Validate stored user state exists and is valid
+ * @param userState - userState returned by oidcClient.processSigninResponse
+ * @throws when userState is invalid
+ */
+export function validateStoredUserState(userState: unknown): asserts userState is UserState {
+    if (!isRecord(userState)) {
+        logger.error("Stored user state not found");
+        throw new Error(OidcError.MissingOrInvalidStoredState);
+    }
+    const isInvalid = [
+        requiredStringProperty(userState, "homeserverUrl"),
+        requiredStringProperty(userState, "nonce"),
+        optionalStringProperty(userState, "identityServerUrl"),
+    ].some((isValid) => !isValid);
+
+    if (isInvalid) {
+        throw new Error(OidcError.MissingOrInvalidStoredState);
+    }
+}
+
+/**
+ * The expected response type from the token endpoint during authorization code flow
+ * Normalized to always use capitalized 'Bearer' for token_type
+ *
+ * See https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.4,
+ * https://openid.net/specs/openid-connect-basic-1_0.html#TokenOK.
+ */
+export type BearerTokenResponse = {
+    token_type: "Bearer";
+    access_token: string;
+    scope: string;
+    refresh_token?: string;
+    expires_in?: number;
+    // from oidc-client-ts
+    expires_at?: number;
+    id_token?: string;
+};
+
+/**
+ * Make required properties required in type
+ */
+type ValidSignInResponse = SigninResponse &
+    BearerTokenResponse & {
+        token_type: "Bearer" | "bearer";
+    };
+
+const isValidBearerTokenResponse = (response: unknown): response is ValidSignInResponse =>
+    isRecord(response) &&
+    requiredStringProperty(response, "token_type") &&
+    // token_type is case insensitive, some OPs return `token_type: "bearer"`
+    (response["token_type"] as string).toLowerCase() === "bearer" &&
+    requiredStringProperty(response, "access_token") &&
+    requiredStringProperty(response, "refresh_token") &&
+    (!("expires_in" in response) || typeof response["expires_in"] === "number");
+
+export function validateBearerTokenResponse(response: unknown): asserts response is ValidSignInResponse {
+    if (!isValidBearerTokenResponse(response)) {
+        throw new Error(OidcError.InvalidBearerTokenResponse);
+    }
+}
@@ -78,7 +78,7 @@ const DEFAULT_OVERRIDE_RULES: IPushRule[] = [
        conditions: [
            {
                kind: ConditionKind.EventPropertyContains,
-                key: "content.org\\.matrix\\.msc3952\\.mentions.user_ids",
+                key: "content.m\\.mentions.user_ids",
                value: "", // The user ID is dynamically added in rewriteDefaultRules.
            },
        ],
@@ -91,7 +91,7 @@ const DEFAULT_OVERRIDE_RULES: IPushRule[] = [
        conditions: [
            {
                kind: ConditionKind.EventPropertyIs,
-                key: "content.org\\.matrix\\.msc3952\\.mentions.room",
+                key: "content.m\\.mentions.room",
                value: true,
            },
            {
@@ -724,7 +724,7 @@ export class PushProcessor {
        // Disable the deprecated mentions push rules if the new mentions property exists.
        if (
            this.client.supportsIntentionalMentions() &&
-            ev.getContent()["org.matrix.msc3952.mentions"] !== undefined &&
+            ev.getContent()["m.mentions"] !== undefined &&
            (rule.rule_id === RuleId.ContainsUserName ||
                rule.rule_id === RuleId.ContainsDisplayName ||
                rule.rule_id === RuleId.AtRoomNotification)
@@ -17,7 +17,12 @@ limitations under the License.
 import { UnstableValue } from "matrix-events-sdk";

 import { RendezvousChannel, RendezvousFailureListener, RendezvousFailureReason, RendezvousIntent } from ".";
-import { IMSC3882GetLoginTokenCapability, MatrixClient, UNSTABLE_MSC3882_CAPABILITY } from "../client";
+import {
+    ICrossSigningKey,
+    IMSC3882GetLoginTokenCapability,
+    MatrixClient,
+    UNSTABLE_MSC3882_CAPABILITY,
+} from "../client";
 import { CrossSigningInfo } from "../crypto/CrossSigning";
 import { DeviceInfo } from "../crypto/deviceinfo";
 import { buildFeatureSupportMap, Feature, ServerSupport } from "../feature";
@@ -178,7 +183,9 @@ export class MSC3906Rendezvous {
        return deviceId;
    }

-    private async verifyAndCrossSignDevice(deviceInfo: DeviceInfo): Promise<CrossSigningInfo | DeviceInfo> {
+    private async verifyAndCrossSignDevice(
+        deviceInfo: DeviceInfo,
+    ): Promise<CrossSigningInfo | DeviceInfo | ICrossSigningKey | undefined> {
        if (!this.client.crypto) {
            throw new Error("Crypto not available on client");
        }
@@ -223,7 +230,7 @@ export class MSC3906Rendezvous {
     */
    public async verifyNewDeviceOnExistingDevice(
        timeout = 10 * 1000,
-    ): Promise<DeviceInfo | CrossSigningInfo | undefined> {
+    ): Promise<DeviceInfo | CrossSigningInfo | ICrossSigningKey | undefined> {
        if (!this.newDeviceId) {
            throw new Error("No new device to sign");
        }
@@ -14,19 +14,26 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { OlmMachine, CrossSigningStatus } from "@matrix-org/matrix-sdk-crypto-js";
+import { OlmMachine, CrossSigningStatus } from "@matrix-org/matrix-sdk-crypto-wasm";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

 import { BootstrapCrossSigningOpts } from "../crypto-api";
 import { logger } from "../logger";
 import { OutgoingRequest, OutgoingRequestProcessor } from "./OutgoingRequestProcessor";
 import { UIAuthCallback } from "../interactive-auth";
+import { ServerSideSecretStorage } from "../secret-storage";

 /** Manages the cross-signing keys for our own user.
+ *
+ * @internal
 */
 export class CrossSigningIdentity {
    public constructor(
        private readonly olmMachine: OlmMachine,
        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,
+        private readonly secretStorage: ServerSideSecretStorage,
+        /** Called if the cross signing keys are imported from the secret storage */
+        private readonly onCrossSigningKeysImport: () => void,
    ) {}

    /**
@@ -39,7 +46,15 @@ export class CrossSigningIdentity {
        }

        const olmDeviceStatus: CrossSigningStatus = await this.olmMachine.crossSigningStatus();
-        const privateKeysInSecretStorage = false; // TODO
+
+        // Try to fetch cross signing keys from the secret storage
+        const masterKeyFromSecretStorage = await this.secretStorage.get("m.cross_signing.master");
+        const selfSigningKeyFromSecretStorage = await this.secretStorage.get("m.cross_signing.self_signing");
+        const userSigningKeyFromSecretStorage = await this.secretStorage.get("m.cross_signing.user_signing");
+        const privateKeysInSecretStorage = Boolean(
+            masterKeyFromSecretStorage && selfSigningKeyFromSecretStorage && userSigningKeyFromSecretStorage,
+        );
+
        const olmDeviceHasKeys =
            olmDeviceStatus.hasMaster && olmDeviceStatus.hasUserSigning && olmDeviceStatus.hasSelfSigning;

@@ -65,7 +80,23 @@ export class CrossSigningIdentity {
                "bootStrapCrossSigning: Cross-signing private keys not found locally, but they are available " +
                    "in secret storage, reading storage and caching locally",
            );
-            throw new Error("TODO");
+            await this.olmMachine.importCrossSigningKeys(
+                masterKeyFromSecretStorage,
+                selfSigningKeyFromSecretStorage,
+                userSigningKeyFromSecretStorage,
+            );
+
+            // Get the current device
+            const device: RustSdkCryptoJs.Device = await this.olmMachine.getDevice(
+                this.olmMachine.userId,
+                this.olmMachine.deviceId,
+            );
+
+            // Sign the device with our cross-signing key and upload the signature
+            const request: RustSdkCryptoJs.SignatureUploadRequest = await device.verify();
+            await this.outgoingRequestProcessor.makeOutgoingRequest(request);
+
+            this.onCrossSigningKeysImport();
        }

        // TODO: we might previously have bootstrapped cross-signing but not completed uploading the keys to the
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { OlmMachine, UserId } from "@matrix-org/matrix-sdk-crypto-js";
+import { OlmMachine, UserId } from "@matrix-org/matrix-sdk-crypto-wasm";

 import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor";

@@ -22,6 +22,8 @@ import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor";
 * KeyClaimManager: linearises calls to OlmMachine.getMissingSessions to avoid races
 *
 * We have one of these per `RustCrypto` (and hence per `MatrixClient`).
+ *
+ * @internal
 */
 export class KeyClaimManager {
    private currentClaimPromise: Promise<void>;
@@ -24,7 +24,7 @@ import {
    SignatureUploadRequest,
    ToDeviceRequest,
    SigningKeysUploadRequest,
-} from "@matrix-org/matrix-sdk-crypto-js";
+} from "@matrix-org/matrix-sdk-crypto-wasm";

 import { logger } from "../logger";
 import { IHttpOpts, MatrixHttpApi, Method } from "../http-api";
@@ -34,6 +34,8 @@ import { UIAResponse } from "../@types/uia";

 /**
 * Common interface for all the request types returned by `OlmMachine.outgoingRequests`.
+ *
+ * @internal
 */
 export interface OutgoingRequest {
    readonly id: string | undefined;
@@ -49,6 +51,8 @@ export interface OutgoingRequest {
 *   * holding the reference to the `MatrixHttpApi`
 *   * turning `OutgoingRequest`s from the rust backend into HTTP requests, and sending them
 *   * sending the results of such requests back to the rust backend.
+ *
+ * @internal
 */
 export class OutgoingRequestProcessor {
    public constructor(
@@ -112,11 +116,13 @@ export class OutgoingRequestProcessor {
        }

        const parsedBody = JSON.parse(body);
-        const makeRequest = async (auth: IAuthDict): Promise<UIAResponse<T>> => {
-            const newBody = {
+        const makeRequest = async (auth: IAuthDict | null): Promise<UIAResponse<T>> => {
+            const newBody: Record<string, any> = {
                ...parsedBody,
-                auth,
            };
+            if (auth !== null) {
+                newBody.auth = auth;
+            }
            const resp = await this.rawJsonRequest(method, path, queryParams, JSON.stringify(newBody));
            return JSON.parse(resp) as T;
        };
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import { EncryptionSettings, OlmMachine, RoomId, UserId } from "@matrix-org/matrix-sdk-crypto-js";
+import { EncryptionSettings, OlmMachine, RoomId, UserId } from "@matrix-org/matrix-sdk-crypto-wasm";

 import { EventType } from "../@types/event";
 import { IContent, MatrixEvent } from "../models/event";
@@ -26,6 +26,8 @@ import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor";

 /**
 * RoomEncryptor: responsible for encrypting messages to a given room
+ *
+ * @internal
 */
 export class RoomEncryptor {
    private readonly prefixedLogger: PrefixedLogger;
@@ -0,0 +1,55 @@
+/*
+Copyright 2023 The Matrix.org Foundation C.I.C.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import { OlmMachine, SignatureVerification } from "@matrix-org/matrix-sdk-crypto-wasm";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+
+import { BackupTrustInfo, Curve25519AuthData, KeyBackupInfo } from "../crypto-api/keybackup";
+
+/**
+ * @internal
+ */
+export class RustBackupManager {
+    public constructor(private readonly olmMachine: OlmMachine) {}
+
+    /**
+     * Get the backup version we are currently backing up to, if any
+     */
+    public async getActiveBackupVersion(): Promise<string | null> {
+        // TODO stub
+        return null;
+    }
+
+    /**
+     * Determine if a key backup can be trusted.
+     *
+     * @param info - key backup info dict from {@link MatrixClient#getKeyBackupVersion}.
+     */
+    public async isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo> {
+        const signatureVerification: SignatureVerification = await this.olmMachine.verifyBackup(info);
+
+        const backupKeys: RustSdkCryptoJs.BackupKeys = await this.olmMachine.getBackupKeys();
+        const pubKeyForSavedPrivateKey = backupKeys?.decryptionKey?.megolmV1PublicKey;
+        const backupMatchesSavedPrivateKey =
+            info.algorithm === pubKeyForSavedPrivateKey?.algorithm &&
+            (info.auth_data as Curve25519AuthData)?.public_key === pubKeyForSavedPrivateKey.publicKeyBase64;
+
+        return {
+            matchesDecryptionKey: backupMatchesSavedPrivateKey,
+            trusted: signatureVerification.trusted(),
+        };
+    }
+}
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

 import { Device, DeviceVerification } from "../models/device";
 import { DeviceKeys } from "../client";
@@ -23,6 +23,8 @@ import { DeviceKeys } from "../client";
 * Convert a {@link RustSdkCryptoJs.Device} to a {@link Device}
 * @param device - Rust Sdk device
 * @param userId - owner of the device
+ *
+ * @internal
 */
 export function rustDeviceToJsDevice(device: RustSdkCryptoJs.Device, userId: RustSdkCryptoJs.UserId): Device {
    // Copy rust device keys to Device.keys
@@ -84,6 +86,8 @@ export function rustDeviceToJsDevice(device: RustSdkCryptoJs.Device, userId: Rus
 /**
 * Convert {@link DeviceKeys}  from `/keys/query` request to a `Map<string, Device>`
 * @param deviceKeys - Device keys object to convert
+ *
+ * @internal
 */
 export function deviceKeysToDeviceMap(deviceKeys: DeviceKeys): Map<string, Device> {
    return new Map(
@@ -97,6 +101,8 @@ type QueryDevice = DeviceKeys[keyof DeviceKeys];
 /**
 * Convert `/keys/query` {@link QueryDevice} device to {@link Device}
 * @param device - Device from `/keys/query` request
+ *
+ * @internal
 */
 export function downloadDeviceToJsDevice(device: QueryDevice): Device {
    const keys = new Map(Object.entries(device.keys));
@@ -14,11 +14,10 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

 import { RustCrypto } from "./rust-crypto";
 import { logger } from "../logger";
-import { RUST_SDK_STORE_PREFIX } from "./constants";
 import { IHttpOpts, MatrixHttpApi } from "../http-api";
 import { ServerSideSecretStorage } from "../secret-storage";
 import { ICryptoCallbacks } from "../crypto";
@@ -32,6 +31,10 @@ import { ICryptoCallbacks } from "../crypto";
 * @param deviceId - The local user's Device ID.
 * @param secretStorage - Interface to server-side secret storage.
 * @param cryptoCallbacks - Crypto callbacks provided by the application
+ * @param storePrefix - the prefix to use on the indexeddbs created by rust-crypto.
+ *     If unset, a memory store will be used.
+ *
+ * @internal
 */
 export async function initRustCrypto(
    http: MatrixHttpApi<IHttpOpts & { onlyData: true }>,
@@ -39,8 +42,9 @@ export async function initRustCrypto(
    deviceId: string,
    secretStorage: ServerSideSecretStorage,
    cryptoCallbacks: ICryptoCallbacks,
+    storePrefix: string | null,
 ): Promise<RustCrypto> {
-    // initialise the rust matrix-sdk-crypto-js, if it hasn't already been done
+    // initialise the rust matrix-sdk-crypto-wasm, if it hasn't already been done
    await RustSdkCryptoJs.initAsync();

    // enable tracing in the rust-sdk
@@ -51,7 +55,12 @@ export async function initRustCrypto(
    logger.info("Init OlmMachine");

    // TODO: use the pickle key for the passphrase
-    const olmMachine = await RustSdkCryptoJs.OlmMachine.initialize(u, d, RUST_SDK_STORE_PREFIX, "test pass");
+    const olmMachine = await RustSdkCryptoJs.OlmMachine.initialize(
+        u,
+        d,
+        storePrefix ?? undefined,
+        (storePrefix && "test pass") ?? undefined,
+    );
    const rustCrypto = new RustCrypto(olmMachine, http, userId, deviceId, secretStorage, cryptoCallbacks);
    await olmMachine.registerRoomKeyUpdatedCallback((sessions: RustSdkCryptoJs.RoomKeyInfo[]) =>
        rustCrypto.onRoomKeysUpdated(sessions),
@@ -14,12 +14,12 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";

 import type { IEventDecryptionResult, IMegolmSessionData } from "../@types/crypto";
 import type { IDeviceLists, IToDeviceEvent } from "../sync-accumulator";
 import type { IEncryptedEventInfo } from "../crypto/api";
-import { MatrixEvent } from "../models/event";
+import { IContent, MatrixEvent, MatrixEventEvent } from "../models/event";
 import { Room } from "../models/room";
 import { RoomMember } from "../models/room-member";
 import { CryptoBackend, OnSyncCompletedData } from "../common-crypto/CryptoBackend";
@@ -31,16 +31,19 @@ import { OutgoingRequest, OutgoingRequestProcessor } from "./OutgoingRequestProc
 import { KeyClaimManager } from "./KeyClaimManager";
 import { MapWithDefault } from "../utils";
 import {
+    BackupTrustInfo,
    BootstrapCrossSigningOpts,
+    CreateSecretStorageOpts,
    CrossSigningKey,
+    CrossSigningKeyInfo,
    CrossSigningStatus,
+    CryptoCallbacks,
    DeviceVerificationStatus,
    GeneratedSecretStorageKey,
    ImportRoomKeyProgressData,
    ImportRoomKeysOpts,
+    KeyBackupInfo,
    VerificationRequest,
-    CreateSecretStorageOpts,
-    CryptoCallbacks,
 } from "../crypto-api";
 import { deviceKeysToDeviceMap, rustDeviceToJsDevice } from "./device-converter";
 import { IDownloadKeyResult, IQueryKeysRequest } from "../client";
@@ -52,11 +55,19 @@ import { keyFromPassphrase } from "../crypto/key_passphrase";
 import { encodeRecoveryKey } from "../crypto/recoverykey";
 import { crypto } from "../crypto/crypto";
 import { RustVerificationRequest, verificationMethodIdentifierToMethod } from "./verification";
+import { EventType, MsgType } from "../@types/event";
+import { CryptoEvent } from "../crypto";
+import { TypedEventEmitter } from "../models/typed-event-emitter";
+import { RustBackupManager } from "./backup";
+
+const ALL_VERIFICATION_METHODS = ["m.sas.v1", "m.qr_code.scan.v1", "m.qr_code.show.v1", "m.reciprocate.v1"];

 /**
 * An implementation of {@link CryptoBackend} using the Rust matrix-sdk-crypto.
+ *
+ * @internal
 */
-export class RustCrypto implements CryptoBackend {
+export class RustCrypto extends TypedEventEmitter<RustCryptoEvents, RustCryptoEventMap> implements CryptoBackend {
    public globalErrorOnUnknownDevices = false;
    private _trustCrossSignedDevices = true;

@@ -74,6 +85,8 @@ export class RustCrypto implements CryptoBackend {
    private outgoingRequestProcessor: OutgoingRequestProcessor;
    private crossSigningIdentity: CrossSigningIdentity;

+    public readonly backupManager: RustBackupManager;
+
    public constructor(
        /** The `OlmMachine` from the underlying rust crypto sdk. */
        private readonly olmMachine: RustSdkCryptoJs.OlmMachine,
@@ -97,10 +110,22 @@ export class RustCrypto implements CryptoBackend {
        /** Crypto callbacks provided by the application */
        private readonly cryptoCallbacks: CryptoCallbacks,
    ) {
+        super();
        this.outgoingRequestProcessor = new OutgoingRequestProcessor(olmMachine, http);
        this.keyClaimManager = new KeyClaimManager(olmMachine, this.outgoingRequestProcessor);
        this.eventDecryptor = new EventDecryptor(olmMachine);
-        this.crossSigningIdentity = new CrossSigningIdentity(olmMachine, this.outgoingRequestProcessor);
+        this.backupManager = new RustBackupManager(olmMachine);
+
+        // Fire if the cross signing keys are imported from the secret storage
+        const onCrossSigningKeysImport = (): void => {
+            this.emit(CryptoEvent.UserTrustStatusChanged, this.userId, this.checkUserTrust(this.userId));
+        };
+        this.crossSigningIdentity = new CrossSigningIdentity(
+            olmMachine,
+            this.outgoingRequestProcessor,
+            secretStorage,
+            onCrossSigningKeysImport,
+        );
    }

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -186,6 +211,20 @@ export class RustCrypto implements CryptoBackend {
        return null;
    }

+    /**
+     * This function is unneeded for the rust-crypto.
+     * The cross signing key import and the device verification are done in {@link CryptoApi#bootstrapCrossSigning}
+     *
+     * The function is stub to keep the compatibility with the old crypto.
+     * More information: https://github.com/vector-im/element-web/issues/25648
+     *
+     *
+     * Implementation of {@link CryptoBackend#checkOwnCrossSigningTrust}
+     */
+    public async checkOwnCrossSigningTrust(): Promise<void> {
+        return;
+    }
+
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    //
    // CryptoApi implementation
@@ -198,7 +237,13 @@ export class RustCrypto implements CryptoBackend {
     * Implementation of {@link CryptoApi.userHasCrossSigningKeys}.
     */
    public async userHasCrossSigningKeys(): Promise<boolean> {
-        const userIdentity = await this.olmMachine.getIdentity(new RustSdkCryptoJs.UserId(this.userId));
+        const userId = new RustSdkCryptoJs.UserId(this.userId);
+        /* make sure we have an *up-to-date* idea of the user's cross-signing keys. This is important, because if we
+         * return "false" here, we will end up generating new cross-signing keys and replacing the existing ones.
+         */
+        const request = this.olmMachine.queryKeysForUsers([userId]);
+        await this.outgoingRequestProcessor.makeOutgoingRequest(request);
+        const userIdentity = await this.olmMachine.getIdentity(userId);
        return userIdentity !== undefined;
    }

@@ -282,15 +327,31 @@ export class RustCrypto implements CryptoBackend {
     */
    private async getUserDevices(userId: string): Promise<Map<string, Device>> {
        const rustUserId = new RustSdkCryptoJs.UserId(userId);
-        const devices: RustSdkCryptoJs.UserDevices = await this.olmMachine.getUserDevices(rustUserId);
-        return new Map(
-            devices
-                .devices()
-                .map((device: RustSdkCryptoJs.Device) => [
-                    device.deviceId.toString(),
-                    rustDeviceToJsDevice(device, rustUserId),
-                ]),
-        );
+
+        // For reasons I don't really understand, the Javascript FinalizationRegistry doesn't seem to run the
+        // registered callbacks when `userDevices` goes out of scope, nor when the individual devices in the array
+        // returned by `userDevices.devices` do so.
+        //
+        // This is particularly problematic, because each of those structures holds a reference to the
+        // VerificationMachine, which in turn holds a reference to the IndexeddbCryptoStore. Hence, we end up leaking
+        // open connections to the crypto store, which means the store can't be deleted on logout.
+        //
+        // To fix this, we explicitly call `.free` on each of the objects, which tells the rust code to drop the
+        // allocated memory and decrement the refcounts for the crypto store.
+
+        const userDevices: RustSdkCryptoJs.UserDevices = await this.olmMachine.getUserDevices(rustUserId);
+        try {
+            const deviceArray: RustSdkCryptoJs.Device[] = userDevices.devices();
+            try {
+                return new Map(
+                    deviceArray.map((device) => [device.deviceId.toString(), rustDeviceToJsDevice(device, rustUserId)]),
+                );
+            } finally {
+                deviceArray.forEach((d) => d.free());
+            }
+        } finally {
+            userDevices.free();
+        }
    }

    /**
@@ -322,6 +383,23 @@ export class RustCrypto implements CryptoBackend {
        //  events. Maybe we need to do the same?
    }

+    /**
+     * Mark the given device as locally verified.
+     *
+     * Implementation of {@link CryptoApi#setDeviceVerified}.
+     */
+    public async setDeviceVerified(userId: string, deviceId: string, verified = true): Promise<void> {
+        const device: RustSdkCryptoJs.Device | undefined = await this.olmMachine.getDevice(
+            new RustSdkCryptoJs.UserId(userId),
+            new RustSdkCryptoJs.DeviceId(deviceId),
+        );
+
+        if (!device) {
+            throw new Error(`Unknown device ${userId}|${deviceId}`);
+        }
+        await device.setLocalTrust(verified ? RustSdkCryptoJs.LocalTrust.Verified : RustSdkCryptoJs.LocalTrust.Unset);
+    }
+
    /**
     * Implementation of {@link CryptoApi#getDeviceVerificationStatus}.
     */
@@ -363,8 +441,45 @@ export class RustCrypto implements CryptoBackend {
     * Implementation of {@link CryptoApi#getCrossSigningKeyId}
     */
    public async getCrossSigningKeyId(type: CrossSigningKey = CrossSigningKey.Master): Promise<string | null> {
-        // TODO
-        return null;
+        const userIdentity: RustSdkCryptoJs.OwnUserIdentity | undefined = await this.olmMachine.getIdentity(
+            new RustSdkCryptoJs.UserId(this.userId),
+        );
+
+        const crossSigningStatus: RustSdkCryptoJs.CrossSigningStatus = await this.olmMachine.crossSigningStatus();
+        const privateKeysOnDevice =
+            crossSigningStatus.hasMaster && crossSigningStatus.hasUserSigning && crossSigningStatus.hasSelfSigning;
+
+        if (!userIdentity || !privateKeysOnDevice) {
+            // The public or private keys are not available on this device
+            return null;
+        }
+
+        if (!userIdentity.isVerified()) {
+            // We have both public and private keys, but they don't match!
+            return null;
+        }
+
+        let key: string;
+        switch (type) {
+            case CrossSigningKey.Master:
+                key = userIdentity.masterKey;
+                break;
+            case CrossSigningKey.SelfSigning:
+                key = userIdentity.selfSigningKey;
+                break;
+            case CrossSigningKey.UserSigning:
+                key = userIdentity.userSigningKey;
+                break;
+            default:
+                // Unknown type
+                return null;
+        }
+
+        const parsedKey: CrossSigningKeyInfo = JSON.parse(key);
+        // `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
+        // We assume only a single key, and we want the bare form without type
+        // prefix, so we select the values.
+        return Object.values(parsedKey.keys)[0];
    }

    /**
@@ -545,11 +660,18 @@ export class RustCrypto implements CryptoBackend {
     */
    public getVerificationRequestsToDeviceInProgress(userId: string): VerificationRequest[] {
        const requests: RustSdkCryptoJs.VerificationRequest[] = this.olmMachine.getVerificationRequests(
-            new RustSdkCryptoJs.UserId(this.userId),
+            new RustSdkCryptoJs.UserId(userId),
        );
        return requests
            .filter((request) => request.roomId === undefined)
-            .map((request) => new RustVerificationRequest(request, this.outgoingRequestProcessor));
+            .map(
+                (request) =>
+                    new RustVerificationRequest(
+                        request,
+                        this.outgoingRequestProcessor,
+                        this._supportedVerificationMethods,
+                    ),
+            );
    }

    /**
@@ -558,21 +680,44 @@ export class RustCrypto implements CryptoBackend {
     * Implementation of {@link CryptoApi#findVerificationRequestDMInProgress}
     *
     * @param roomId - the room to use for verification
+     * @param userId - search the verification request for the given user
     *
     * @returns the VerificationRequest that is in progress, if any
     *
     */
-    public findVerificationRequestDMInProgress(roomId: string): undefined {
-        // TODO
-        return;
+    public findVerificationRequestDMInProgress(roomId: string, userId?: string): VerificationRequest | undefined {
+        if (!userId) throw new Error("missing userId");
+
+        const requests: RustSdkCryptoJs.VerificationRequest[] = this.olmMachine.getVerificationRequests(
+            new RustSdkCryptoJs.UserId(userId),
+        );
+
+        // Search for the verification request for the given room id
+        const request = requests.find((request) => request.roomId?.toString() === roomId);
+
+        if (request) {
+            return new RustVerificationRequest(
+                request,
+                this.outgoingRequestProcessor,
+                this._supportedVerificationMethods,
+            );
+        }
    }

    /**
     * The verification methods we offer to the other side during an interactive verification.
+     */
+    private _supportedVerificationMethods: string[] = ALL_VERIFICATION_METHODS;
+
+    /**
+     * Set the verification methods we offer to the other side during an interactive verification.
     *
     * If `undefined`, we will offer all the methods supported by the Rust SDK.
     */
-    public supportedVerificationMethods: string[] | undefined;
+    public setSupportedVerificationMethods(methods: string[] | undefined): void {
+        // by default, the Rust SDK does not offer `m.qr_code.scan.v1`, but we do want to offer that.
+        this._supportedVerificationMethods = methods ?? ALL_VERIFICATION_METHODS;
+    }

    /**
     * Send a verification request to our other devices.
@@ -593,10 +738,10 @@ export class RustCrypto implements CryptoBackend {

        const [request, outgoingRequest]: [RustSdkCryptoJs.VerificationRequest, RustSdkCryptoJs.ToDeviceRequest] =
            await userIdentity.requestVerification(
-                this.supportedVerificationMethods?.map(verificationMethodIdentifierToMethod),
+                this._supportedVerificationMethods.map(verificationMethodIdentifierToMethod),
            );
        await this.outgoingRequestProcessor.makeOutgoingRequest(outgoingRequest);
-        return new RustVerificationRequest(request, this.outgoingRequestProcessor);
+        return new RustVerificationRequest(request, this.outgoingRequestProcessor, this._supportedVerificationMethods);
    }

    /**
@@ -623,10 +768,55 @@ export class RustCrypto implements CryptoBackend {

        const [request, outgoingRequest]: [RustSdkCryptoJs.VerificationRequest, RustSdkCryptoJs.ToDeviceRequest] =
            await device.requestVerification(
-                this.supportedVerificationMethods?.map(verificationMethodIdentifierToMethod),
+                this._supportedVerificationMethods.map(verificationMethodIdentifierToMethod),
            );
        await this.outgoingRequestProcessor.makeOutgoingRequest(outgoingRequest);
-        return new RustVerificationRequest(request, this.outgoingRequestProcessor);
+        return new RustVerificationRequest(request, this.outgoingRequestProcessor, this._supportedVerificationMethods);
+    }
+
+    /**
+     * Fetch the backup decryption key we have saved in our store.
+     *
+     * Implementation of {@link CryptoApi#getSessionBackupPrivateKey}.
+     *
+     * @returns the key, if any, or null
+     */
+    public async getSessionBackupPrivateKey(): Promise<Uint8Array | null> {
+        const backupKeys: RustSdkCryptoJs.BackupKeys = await this.olmMachine.getBackupKeys();
+        if (!backupKeys.decryptionKey) return null;
+        return Buffer.from(backupKeys.decryptionKey.toBase64(), "base64");
+    }
+
+    /**
+     * Store the backup decryption key.
+     *
+     * Implementation of {@link CryptoApi#storeSessionBackupPrivateKey}.
+     *
+     * @param key - the backup decryption key
+     */
+    public async storeSessionBackupPrivateKey(key: Uint8Array): Promise<void> {
+        const base64Key = Buffer.from(key).toString("base64");
+
+        // TODO get version from backupManager
+        await this.olmMachine.saveBackupDecryptionKey(RustSdkCryptoJs.BackupDecryptionKey.fromBase64(base64Key), "");
+    }
+
+    /**
+     * Get the current status of key backup.
+     *
+     * Implementation of {@link CryptoApi#getActiveSessionBackupVersion}.
+     */
+    public async getActiveSessionBackupVersion(): Promise<string | null> {
+        return await this.backupManager.getActiveBackupVersion();
+    }
+
+    /**
+     * Determine if a key backup can be trusted.
+     *
+     * Implementation of {@link Crypto.CryptoApi.isKeyBackupTrusted}.
+     */
+    public async isKeyBackupTrusted(info: KeyBackupInfo): Promise<BackupTrustInfo> {
+        return await this.backupManager.isKeyBackupTrusted(info);
    }

    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
@@ -670,10 +860,18 @@ export class RustCrypto implements CryptoBackend {
     * @param events - the received to-device messages
     * @returns A list of preprocessed to-device messages.
     */
-    public preprocessToDeviceMessages(events: IToDeviceEvent[]): Promise<IToDeviceEvent[]> {
+    public async preprocessToDeviceMessages(events: IToDeviceEvent[]): Promise<IToDeviceEvent[]> {
        // send the received to-device messages into receiveSyncChanges. We have no info on device-list changes,
        // one-time-keys, or fallback keys, so just pass empty data.
-        return this.receiveSyncChanges({ events });
+        const processed = await this.receiveSyncChanges({ events });
+
+        // look for interesting to-device messages
+        for (const message of processed) {
+            if (message.type === EventType.KeyVerificationRequest) {
+                this.onIncomingKeyVerificationRequest(message.sender, message.content);
+            }
+        }
+        return processed;
    }

    /** called by the sync loop to process one time key counts and unused fallback keys
@@ -751,6 +949,32 @@ export class RustCrypto implements CryptoBackend {
        this.outgoingRequestLoop();
    }

+    /**
+     * Handle an incoming m.key.verification request event
+     *
+     * @param sender - the sender of the event
+     * @param content - the content of the event
+     */
+    private onIncomingKeyVerificationRequest(sender: string, content: IContent): void {
+        const transactionId = content.transaction_id;
+        if (!transactionId || !sender) {
+            // not a valid request: ignore
+            return;
+        }
+
+        const request: RustSdkCryptoJs.VerificationRequest | undefined = this.olmMachine.getVerificationRequest(
+            new RustSdkCryptoJs.UserId(sender),
+            transactionId,
+        );
+
+        if (request) {
+            this.emit(
+                CryptoEvent.VerificationRequestReceived,
+                new RustVerificationRequest(request, this.outgoingRequestProcessor, this._supportedVerificationMethods),
+            );
+        }
+    }
+
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    //
    // Other public functions
@@ -809,6 +1033,73 @@ export class RustCrypto implements CryptoBackend {
        }
    }

+    /**
+     * Handle a live event received via /sync.
+     * See {@link ClientEventHandlerMap#event}
+     *
+     * @param event - live event
+     */
+    public async onLiveEventFromSync(event: MatrixEvent): Promise<void> {
+        // Ignore state event
+        if (event.isState()) return;
+
+        const processEvent = async (evt: MatrixEvent): Promise<void> => {
+            // Process only key validation request
+            if (
+                evt.getType() === EventType.RoomMessage &&
+                evt.getContent().msgtype === MsgType.KeyVerificationRequest
+            ) {
+                await this.onKeyVerificationRequest(evt);
+            }
+        };
+
+        // If the event is encrypted of in failure, we wait for decryption
+        if (event.isDecryptionFailure() || event.isEncrypted()) {
+            // 5 mins
+            const TIMEOUT_DELAY = 5 * 60 * 1000;
+
+            const timeoutId = setTimeout(() => event.off(MatrixEventEvent.Decrypted, onDecrypted), TIMEOUT_DELAY);
+
+            const onDecrypted = (decryptedEvent: MatrixEvent, error?: Error): void => {
+                if (error) return;
+
+                clearTimeout(timeoutId);
+                event.off(MatrixEventEvent.Decrypted, onDecrypted);
+                processEvent(decryptedEvent);
+            };
+            // After 5mins, we are not expecting the event to be decrypted
+
+            event.on(MatrixEventEvent.Decrypted, onDecrypted);
+        } else {
+            await processEvent(event);
+        }
+    }
+
+    /**
+     * Handle key verification request.
+     *
+     * @param event - a key validation request event.
+     */
+    private async onKeyVerificationRequest(event: MatrixEvent): Promise<void> {
+        const roomId = event.getRoomId();
+
+        if (!roomId) {
+            throw new Error("missing roomId in the event");
+        }
+
+        await this.olmMachine.receiveVerificationEvent(
+            JSON.stringify({
+                event_id: event.getId(),
+                type: event.getType(),
+                sender: event.getSender(),
+                state_key: event.getStateKey(),
+                content: event.getContent(),
+                origin_server_ts: event.getTs(),
+            }),
+            new RustSdkCryptoJs.RoomId(roomId),
+        );
+    }
+
    ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
    //
    // Outgoing requests
@@ -939,3 +1230,17 @@ class EventDecryptor {
        }
    }
 }
+
+type RustCryptoEvents = CryptoEvent.VerificationRequestReceived | CryptoEvent.UserTrustStatusChanged;
+
+type RustCryptoEventMap = {
+    /**
+     * Fires when a key verification request is received.
+     */
+    [CryptoEvent.VerificationRequestReceived]: (request: VerificationRequest) => void;
+
+    /**
+     * Fires when the cross signing keys are imported during {@link CryptoApi#bootstrapCrossSigning}
+     */
+    [CryptoEvent.UserTrustStatusChanged]: (userId: string, userTrustLevel: UserTrustLevel) => void;
+};
@@ -21,6 +21,8 @@ import { ServerSideSecretStorage } from "../secret-storage";
 *
 * @param secretStorage - The secret store using account data
 * @returns True if the cross-signing keys are all stored and encrypted with the same secret storage key.
+ *
+ * @internal
 */
 export async function secretStorageContainsCrossSigningKeys(secretStorage: ServerSideSecretStorage): Promise<boolean> {
    // Check if the master cross-signing key is stored in secret storage
@@ -14,8 +14,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */

-import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-js";
-import { Emoji } from "@matrix-org/matrix-sdk-crypto-js";
+import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
+import { Emoji, QrState } from "@matrix-org/matrix-sdk-crypto-wasm";

 import {
    ShowQrCodeCallbacks,
@@ -30,30 +30,55 @@ import {
 } from "../crypto-api/verification";
 import { TypedEventEmitter } from "../models/typed-event-emitter";
 import { OutgoingRequest, OutgoingRequestProcessor } from "./OutgoingRequestProcessor";
+import { TypedReEmitter } from "../ReEmitter";

 /**
 * An incoming, or outgoing, request to verify a user or a device via cross-signing.
+ *
+ * @internal
 */
 export class RustVerificationRequest
    extends TypedEventEmitter<VerificationRequestEvent, VerificationRequestEventHandlerMap>
    implements VerificationRequest
 {
-    private _verifier: Verifier | undefined;
+    /** a reëmitter which relays VerificationRequestEvent.Changed events emitted by the verifier */
+    private readonly reEmitter: TypedReEmitter<VerificationRequestEvent, VerificationRequestEventHandlerMap>;

+    /** Are we in the process of sending an `m.key.verification.ready` event? */
+    private _accepting = false;
+
+    /** Are we in the process of sending an `m.key.verification.cancellation` event? */
+    private _cancelling = false;
+
+    private _verifier: undefined | RustSASVerifier | RustQrCodeVerifier;
+
+    /**
+     * Construct a new RustVerificationRequest to wrap the rust-level `VerificationRequest`.
+     *
+     * @param inner - VerificationRequest from the Rust SDK
+     * @param outgoingRequestProcessor - `OutgoingRequestProcessor` to use for making outgoing HTTP requests
+     * @param supportedVerificationMethods - Verification methods to use when `accept()` is called
+     */
    public constructor(
        private readonly inner: RustSdkCryptoJs.VerificationRequest,
        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,
+        private readonly supportedVerificationMethods: string[],
    ) {
        super();

+        this.reEmitter = new TypedReEmitter(this);
+
        const onChange = async (): Promise<void> => {
-            // if we now have a `Verification` where we lacked one before, wrap it.
-            // TODO: QR support
-            if (this._verifier === undefined) {
-                const verification: RustSdkCryptoJs.Qr | RustSdkCryptoJs.Sas | undefined = this.inner.getVerification();
-                if (verification instanceof RustSdkCryptoJs.Sas) {
-                    this._verifier = new RustSASVerifier(verification, this, outgoingRequestProcessor);
+            const verification: RustSdkCryptoJs.Qr | RustSdkCryptoJs.Sas | undefined = this.inner.getVerification();
+
+            // If we now have a `Verification` where we lacked one before, or we have transitioned from QR to SAS,
+            // wrap the new rust Verification as a js-sdk Verifier.
+            if (verification instanceof RustSdkCryptoJs.Sas) {
+                if (this._verifier === undefined || this._verifier instanceof RustQrCodeVerifier) {
+                    this.setVerifier(new RustSASVerifier(verification, this, outgoingRequestProcessor));
                }
+            } else if (verification instanceof RustSdkCryptoJs.Qr && this._verifier === undefined) {
+                this.setVerifier(new RustQrCodeVerifier(verification, outgoingRequestProcessor));
            }

            this.emit(VerificationRequestEvent.Change);
@@ -61,6 +86,15 @@ export class RustVerificationRequest
        inner.registerChangesCallback(onChange);
    }

+    private setVerifier(verifier: RustSASVerifier | RustQrCodeVerifier): void {
+        // if we already have a verifier, unsubscribe from its events
+        if (this._verifier) {
+            this.reEmitter.stopReEmitting(this._verifier, [VerificationRequestEvent.Change]);
+        }
+        this._verifier = verifier;
+        this.reEmitter.reEmit(this._verifier, [VerificationRequestEvent.Change]);
+    }
+
    /**
     * Unique ID for this verification request.
     *
@@ -113,9 +147,15 @@ export class RustVerificationRequest
            case RustSdkCryptoJs.VerificationRequestPhase.Requested:
                return VerificationPhase.Requested;
            case RustSdkCryptoJs.VerificationRequestPhase.Ready:
-                return VerificationPhase.Ready;
+                // if we're still sending the `m.key.verification.ready`, that counts as "Requested" in the js-sdk's
+                // parlance.
+                return this._accepting ? VerificationPhase.Requested : VerificationPhase.Ready;
            case RustSdkCryptoJs.VerificationRequestPhase.Transitioned:
-                return VerificationPhase.Started;
+                if (!this._verifier) {
+                    // this shouldn't happen, because the onChange handler should have created a _verifier.
+                    throw new Error("VerificationRequest: inner phase == Transitioned but no verifier!");
+                }
+                return this._verifier.verificationPhase;
            case RustSdkCryptoJs.VerificationRequestPhase.Done:
                return VerificationPhase.Done;
            case RustSdkCryptoJs.VerificationRequestPhase.Cancelled:
@@ -129,7 +169,9 @@ export class RustVerificationRequest
     * (ie it is in phase `Requested`, `Ready` or `Started`).
     */
    public get pending(): boolean {
-        throw new Error("not implemented");
+        if (this.inner.isPassive()) return false;
+        const phase = this.phase;
+        return phase !== VerificationPhase.Done && phase !== VerificationPhase.Cancelled;
    }

    /**
@@ -137,7 +179,7 @@ export class RustVerificationRequest
     * the remote echo which causes a transition to {@link VerificationPhase.Ready}.
     */
    public get accepting(): boolean {
-        throw new Error("not implemented");
+        return this._accepting;
    }

    /**
@@ -145,7 +187,7 @@ export class RustVerificationRequest
     * the remote echo which causes a transition to {@link VerificationPhase.Cancelled}).
     */
    public get declining(): boolean {
-        throw new Error("not implemented");
+        return this._cancelling;
    }

    /**
@@ -154,7 +196,7 @@ export class RustVerificationRequest
     * `null` indicates that there is no timeout
     */
    public get timeout(): number | null {
-        throw new Error("not implemented");
+        return this.inner.timeRemainingMillis();
    }

    /** once the phase is Started (and !initiatedByMe) or Ready: common methods supported by both sides */
@@ -164,10 +206,13 @@ export class RustVerificationRequest

    /** the method picked in the .start event */
    public get chosenMethod(): string | null {
+        if (this.phase !== VerificationPhase.Started) return null;
+
        const verification: RustSdkCryptoJs.Qr | RustSdkCryptoJs.Sas | undefined = this.inner.getVerification();
-        // TODO: this isn't quite right. The existence of a Verification doesn't prove that we have .started.
        if (verification instanceof RustSdkCryptoJs.Sas) {
            return "m.sas.v1";
+        } else if (verification instanceof RustSdkCryptoJs.Qr) {
+            return "m.reciprocate.v1";
        } else {
            return null;
        }
@@ -198,8 +243,25 @@ export class RustVerificationRequest
     *
     * @returns Promise which resolves when the event has been sent.
     */
-    public accept(): Promise<void> {
-        throw new Error("not implemented");
+    public async accept(): Promise<void> {
+        if (this.inner.phase() !== RustSdkCryptoJs.VerificationRequestPhase.Requested || this._accepting) {
+            throw new Error(`Cannot accept a verification request in phase ${this.phase}`);
+        }
+
+        this._accepting = true;
+        try {
+            const req: undefined | OutgoingRequest = this.inner.acceptWithMethods(
+                this.supportedVerificationMethods.map(verificationMethodIdentifierToMethod),
+            );
+            if (req) {
+                await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+            }
+        } finally {
+            this._accepting = false;
+        }
+
+        // phase may have changed, so emit a 'change' event
+        this.emit(VerificationRequestEvent.Change);
    }

    /**
@@ -211,9 +273,19 @@ export class RustVerificationRequest
     * @returns Promise which resolves when the event has been sent.
     */
    public async cancel(params?: { reason?: string; code?: string }): Promise<void> {
-        const req: undefined | OutgoingRequest = this.inner.cancel();
-        if (req) {
-            await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+        if (this._cancelling) {
+            // already cancelling; do nothing
+            return;
+        }
+
+        this._cancelling = true;
+        try {
+            const req: undefined | OutgoingRequest = this.inner.cancel();
+            if (req) {
+                await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+            }
+        } finally {
+            this._cancelling = false;
        }
    }

@@ -237,21 +309,89 @@ export class RustVerificationRequest
    }

    /**
-     * The verifier which is doing the actual verification, once the method has been established.
-     * Only defined when the `phase` is Started.
+     * Send an `m.key.verification.start` event to start verification via a particular method.
+     *
+     * Implementation of {@link Crypto.VerificationRequest#startVerification}.
+     *
+     * @param method - the name of the verification method to use.
     */
-    public get verifier(): Verifier | undefined {
+    public async startVerification(method: string): Promise<Verifier> {
+        if (method !== "m.sas.v1") {
+            throw new Error(`Unsupported verification method ${method}`);
+        }
+
+        const res:
+            | [RustSdkCryptoJs.Sas, RustSdkCryptoJs.RoomMessageRequest | RustSdkCryptoJs.ToDeviceRequest]
+            | undefined = await this.inner.startSas();
+
+        if (res) {
+            const [, req] = res;
+            await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+        }
+
+        // this should have triggered the onChange callback, and we should now have a verifier
+        if (!this._verifier) {
+            throw new Error("Still no verifier after startSas() call");
+        }
+
        return this._verifier;
    }

    /**
-     * Get the data for a QR code allowing the other device to verify this one, if it supports it.
+     * Start a QR code verification by providing a scanned QR code for this verification flow.
     *
-     * Only set after a .ready if the other party can scan a QR code, otherwise undefined.
+     * Implementation of {@link Crypto.VerificationRequest#scanQRCode}.
+     *
+     * @param qrCodeData - the decoded QR code.
+     * @returns A verifier; call `.verify()` on it to wait for the other side to complete the verification flow.
+     */
+    public async scanQRCode(uint8Array: Uint8Array): Promise<Verifier> {
+        const scan = RustSdkCryptoJs.QrCodeScan.fromBytes(new Uint8ClampedArray(uint8Array));
+        const verifier: RustSdkCryptoJs.Qr = await this.inner.scanQrCode(scan);
+
+        // this should have triggered the onChange callback, and we should now have a verifier
+        if (!this._verifier) {
+            throw new Error("Still no verifier after scanQrCode() call");
+        }
+
+        // we can immediately trigger the reciprocate request
+        const req: undefined | OutgoingRequest = verifier.reciprocate();
+        if (req) {
+            await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+        }
+
+        return this._verifier;
+    }
+
+    /**
+     * The verifier which is doing the actual verification, once the method has been established.
+     * Only defined when the `phase` is Started.
+     */
+    public get verifier(): Verifier | undefined {
+        // It's possible for us to have a Verifier before a method has been chosen (in particular,
+        // if we are showing a QR code which the other device has not yet scanned. At that point, we could
+        // still switch to SAS).
+        //
+        // In that case, we should not return it to the application yet, since the application will not expect the
+        // Verifier to be replaced during the lifetime of the VerificationRequest.
+        return this.phase === VerificationPhase.Started ? this._verifier : undefined;
+    }
+
+    /**
+     * Stub implementation of {@link Crypto.VerificationRequest#getQRCodeBytes}.
     */
    public getQRCodeBytes(): Buffer | undefined {
-        // TODO
-        return undefined;
+        throw new Error("getQRCodeBytes() unsupported in Rust Crypto; use generateQRCode() instead.");
+    }
+
+    /**
+     * Generate the data for a QR code allowing the other device to verify this one, if it supports it.
+     *
+     * Implementation of {@link Crypto.VerificationRequest#generateQRCode}.
+     */
+    public async generateQRCode(): Promise<Buffer | undefined> {
+        const innerVerifier: RustSdkCryptoJs.Qr = await this.inner.generateQrCode();
+        return Buffer.from(innerVerifier.toBytes());
    }

    /**
@@ -272,22 +412,28 @@ export class RustVerificationRequest
    }
 }

-export class RustSASVerifier extends TypedEventEmitter<VerifierEvent, VerifierEventHandlerMap> implements Verifier {
+/** Common base class for `Verifier` implementations which wrap rust classes.
+ *
+ * The generic parameter `InnerType` is the type of the rust Verification class which we wrap.
+ *
+ * @internal
+ */
+abstract class BaseRustVerifer<InnerType extends RustSdkCryptoJs.Qr | RustSdkCryptoJs.Sas> extends TypedEventEmitter<
+    VerifierEvent | VerificationRequestEvent,
+    VerifierEventHandlerMap & VerificationRequestEventHandlerMap
+> {
    /** A promise which completes when the verification completes (or rejects when it is cancelled/fails) */
-    private readonly completionPromise: Promise<void>;
-
-    private callbacks: ShowSasCallbacks | null = null;
+    protected readonly completionPromise: Promise<void>;

    public constructor(
-        private readonly inner: RustSdkCryptoJs.Sas,
-        _verificationRequest: RustVerificationRequest,
-        private readonly outgoingRequestProcessor: OutgoingRequestProcessor,
+        protected readonly inner: InnerType,
+        protected readonly outgoingRequestProcessor: OutgoingRequestProcessor,
    ) {
        super();

        this.completionPromise = new Promise<void>((resolve, reject) => {
            const onChange = async (): Promise<void> => {
-                this.updateCallbacks();
+                this.onChange();

                if (this.inner.isDone()) {
                    resolve(undefined);
@@ -301,6 +447,8 @@ export class RustSASVerifier extends TypedEventEmitter<VerifierEvent, VerifierEv
                        ),
                    );
                }
+
+                this.emit(VerificationRequestEvent.Change);
            };
            inner.registerChangesCallback(onChange);
        });
@@ -308,8 +456,178 @@ export class RustSASVerifier extends TypedEventEmitter<VerifierEvent, VerifierEv
        this.completionPromise.catch(() => null);
    }

+    /**
+     * Hook which is called when the underlying rust class notifies us that there has been a change.
+     *
+     * Can be overridden by subclasses to see if we can notify the application about an update.
+     */
+    protected onChange(): void {}
+
+    /**
+     * Returns true if the verification has been cancelled, either by us or the other side.
+     */
+    public get hasBeenCancelled(): boolean {
+        return this.inner.isCancelled();
+    }
+
+    /**
+     * The ID of the other user in the verification process.
+     */
+    public get userId(): string {
+        return this.inner.otherUserId.toString();
+    }
+
+    /**
+     * Cancel a verification.
+     *
+     * We will send an `m.key.verification.cancel` if the verification is still in flight. The verification promise
+     * will reject, and a {@link Crypto.VerifierEvent#Cancel} will be emitted.
+     *
+     * @param e - the reason for the cancellation.
+     */
+    public cancel(e?: Error): void {
+        // TODO: something with `e`
+        const req: undefined | OutgoingRequest = this.inner.cancel();
+        if (req) {
+            this.outgoingRequestProcessor.makeOutgoingRequest(req);
+        }
+    }
+
+    /**
+     * Get the details for an SAS verification, if one is in progress
+     *
+     * Returns `null`, unless this verifier is for a SAS-based verification and we are waiting for the user to confirm
+     * the SAS matches.
+     */
+    public getShowSasCallbacks(): ShowSasCallbacks | null {
+        return null;
+    }
+
+    /**
+     * Get the details for reciprocating QR code verification, if one is in progress
+     *
+     * Returns `null`, unless this verifier is for reciprocating a QR-code-based verification (ie, the other user has
+     * already scanned our QR code), and we are waiting for the user to confirm.
+     */
+    public getReciprocateQrCodeCallbacks(): ShowQrCodeCallbacks | null {
+        return null;
+    }
+}
+
+/** A Verifier instance which is used to show and/or scan a QR code. */
+export class RustQrCodeVerifier extends BaseRustVerifer<RustSdkCryptoJs.Qr> implements Verifier {
+    private callbacks: ShowQrCodeCallbacks | null = null;
+
+    public constructor(inner: RustSdkCryptoJs.Qr, outgoingRequestProcessor: OutgoingRequestProcessor) {
+        super(inner, outgoingRequestProcessor);
+    }
+
+    protected onChange(): void {
+        // if the other side has scanned our QR code and sent us a "reciprocate" message, it is now time for the
+        // application to prompt the user to confirm their side.
+        if (this.callbacks === null && this.inner.hasBeenScanned()) {
+            this.callbacks = {
+                confirm: () => this.confirmScanning(),
+                cancel: () => this.cancel(),
+            };
+        }
+    }
+
+    /**
+     * Start the key verification, if it has not already been started.
+     *
+     * @returns Promise which resolves when the verification has completed, or rejects if the verification is cancelled
+     *    or times out.
+     */
+    public async verify(): Promise<void> {
+        // Some applications (hello, matrix-react-sdk) may not check if there is a `ShowQrCodeCallbacks` and instead
+        // register a `ShowReciprocateQr` listener which they expect to be called once `.verify` is called.
+        if (this.callbacks !== null) {
+            this.emit(VerifierEvent.ShowReciprocateQr, this.callbacks);
+        }
+        // Nothing to do here but wait.
+        await this.completionPromise;
+    }
+
+    /**
+     * Calculate an appropriate VerificationPhase for a VerificationRequest where this is the verifier.
+     *
+     * This is abnormally complicated because a rust-side QR Code verifier can span several verification phases.
+     */
+    public get verificationPhase(): VerificationPhase {
+        switch (this.inner.state()) {
+            case QrState.Created:
+                // we have created a QR for display; neither side has yet sent an `m.key.verification.start`.
+                return VerificationPhase.Ready;
+            case QrState.Scanned:
+                // other side has scanned our QR and sent an `m.key.verification.start` with `m.reciprocate.v1`
+                return VerificationPhase.Started;
+            case QrState.Confirmed:
+                // we have confirmed the other side's scan and sent an `m.key.verification.done`.
+                return VerificationPhase.Done;
+            case QrState.Reciprocated:
+                // although the rust SDK doesn't immediately send the `m.key.verification.start` on transition into this
+                // state, `RustVerificationRequest.scanQrCode` immediately calls `reciprocate()` and does so, so in practice
+                // we can treat the two the same.
+                return VerificationPhase.Started;
+            case QrState.Done:
+                return VerificationPhase.Done;
+            case QrState.Cancelled:
+                return VerificationPhase.Cancelled;
+            default:
+                throw new Error(`Unknown qr code state ${this.inner.state()}`);
+        }
+    }
+
+    /**
+     * Get the details for reciprocating QR code verification, if one is in progress
+     *
+     * Returns `null`, unless this verifier is for reciprocating a QR-code-based verification (ie, the other user has
+     * already scanned our QR code), and we are waiting for the user to confirm.
+     */
+    public getReciprocateQrCodeCallbacks(): ShowQrCodeCallbacks | null {
+        return this.callbacks;
+    }
+
+    private async confirmScanning(): Promise<void> {
+        const req: undefined | OutgoingRequest = this.inner.confirmScanning();
+        if (req) {
+            await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+        }
+    }
+}
+
+/** A Verifier instance which is used if we are exchanging emojis */
+export class RustSASVerifier extends BaseRustVerifer<RustSdkCryptoJs.Sas> implements Verifier {
+    private callbacks: ShowSasCallbacks | null = null;
+
+    public constructor(
+        inner: RustSdkCryptoJs.Sas,
+        _verificationRequest: RustVerificationRequest,
+        outgoingRequestProcessor: OutgoingRequestProcessor,
+    ) {
+        super(inner, outgoingRequestProcessor);
+    }
+
+    /**
+     * Start the key verification, if it has not already been started.
+     *
+     * This means sending a `m.key.verification.start` if we are the first responder, or a `m.key.verification.accept`
+     * if the other side has already sent a start event.
+     *
+     * @returns Promise which resolves when the verification has completed, or rejects if the verification is cancelled
+     *    or times out.
+     */
+    public async verify(): Promise<void> {
+        const req: undefined | OutgoingRequest = this.inner.accept();
+        if (req) {
+            await this.outgoingRequestProcessor.makeOutgoingRequest(req);
+        }
+        await this.completionPromise;
+    }
+
    /** if we can now show the callbacks, do so */
-    private updateCallbacks(): void {
+    protected onChange(): void {
        if (this.callbacks === null) {
            const emoji: Array<Emoji> | undefined = this.inner.emoji();
            const decimal = this.inner.decimals() as [number, number, number] | undefined;
@@ -341,50 +659,10 @@ export class RustSASVerifier extends TypedEventEmitter<VerifierEvent, VerifierEv
    }

    /**
-     * Returns true if the verification has been cancelled, either by us or the other side.
+     * Calculate an appropriate VerificationPhase for a VerificationRequest where this is the verifier.
     */
-    public get hasBeenCancelled(): boolean {
-        return this.inner.isCancelled();
-    }
-
-    /**
-     * The ID of the other user in the verification process.
-     */
-    public get userId(): string {
-        return this.inner.otherUserId.toString();
-    }
-
-    /**
-     * Start the key verification, if it has not already been started.
-     *
-     * This means sending a `m.key.verification.start` if we are the first responder, or a `m.key.verification.accept`
-     * if the other side has already sent a start event.
-     *
-     * @returns Promise which resolves when the verification has completed, or rejects if the verification is cancelled
-     *    or times out.
-     */
-    public async verify(): Promise<void> {
-        const req: undefined | OutgoingRequest = this.inner.accept();
-        if (req) {
-            await this.outgoingRequestProcessor.makeOutgoingRequest(req);
-        }
-        await this.completionPromise;
-    }
-
-    /**
-     * Cancel a verification.
-     *
-     * We will send an `m.key.verification.cancel` if the verification is still in flight. The verification promise
-     * will reject, and a {@link Crypto.VerifierEvent#Cancel} will be emitted.
-     *
-     * @param e - the reason for the cancellation.
-     */
-    public cancel(e: Error): void {
-        // TODO: something with `e`
-        const req: undefined | OutgoingRequest = this.inner.cancel();
-        if (req) {
-            this.outgoingRequestProcessor.makeOutgoingRequest(req);
-        }
+    public get verificationPhase(): VerificationPhase {
+        return VerificationPhase.Started;
    }

    /**
@@ -396,16 +674,6 @@ export class RustSASVerifier extends TypedEventEmitter<VerifierEvent, VerifierEv
    public getShowSasCallbacks(): ShowSasCallbacks | null {
        return this.callbacks;
    }
-
-    /**
-     * Get the details for reciprocating QR code verification, if one is in progress
-     *
-     * Returns `null`, unless this verifier is for reciprocating a QR-code-based verification (ie, the other user has
-     * already scanned our QR code), and we are waiting for the user to confirm.
-     */
-    public getReciprocateQrCodeCallbacks(): ShowQrCodeCallbacks | null {
-        return null;
-    }
 }

 /** For each specced verification method, the rust-side `VerificationMethod` corresponding to it */
@@ -422,6 +690,8 @@ const verificationMethodsByIdentifier: Record<string, RustSdkCryptoJs.Verificati
 * @param method - specced method identifier, for example `m.sas.v1`.
 * @returns Rust-side `VerificationMethod` corresponding to `method`.
 * @throws An error if the method is unknown.
+ *
+ * @internal
 */
 export function verificationMethodIdentifierToMethod(method: string): RustSdkCryptoJs.VerificationMethod {
    const meth = verificationMethodsByIdentifier[method];
--- a/Show More
+++ b/Show More